<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title>CERT/CC Blog</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/" />
    <link rel="self" type="application/atom+xml" href="https://www.cert.org/blogs/certcc/atom.xml" />
    <id>tag:www.cert.org,2011-02-08:/blogs/certcc//1</id>
    <updated>2013-05-08T13:44:06Z</updated>
    
    <generator uri="http://www.sixapart.com/movabletype/">Movable Type Pro 4.35-en</generator>

<entry>
    <title>Keep Calm and Deploy EMET</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/05/keep_calm_and_deploy_emet.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.160</id>

    <published>2013-05-08T13:44:45Z</published>
    <updated>2013-05-08T13:44:06Z</updated>

    <summary><![CDATA[CVE-2013-1347, the Internet Explorer 8 CGenericElement object use-after-free vulnerability has gotten a lot of press lately because it was used in a &quot;watering hole&quot; attack against several sites....]]></summary>
    <author>
        <name>Jared Allar</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>CVE-2013-1347, the <a href="http://www.kb.cert.org/vuls/id/237655">Internet Explorer 8 CGenericElement object use-after-free vulnerability</a> has gotten <a href="http://arstechnica.com/security/2013/05/internet-explorer-0-day-attacks-on-us-nuke-workers-hit-9-other-sites/">a lot of press lately</a> because it was used in a &quot;<a href="http://en.wikipedia.org/wiki/Watering_Hole">watering hole</a>&quot; attack against several sites.</p>]]>
        <![CDATA[<p>CERT/CC has obtained a sample of an exploit being used in the wild,  and we have verified that Microsoft's EMET tool would have been  effective in blocking this specific exploit. The optional EAF  mitigation that is available in <a href="http://www.microsoft.com/en-us/download/details.aspx?id=29851">EMET 3.0</a> blocks this exploit. By default, <a href="http://www.microsoft.com/en-us/download/details.aspx?id=38761">EMET 4.0 beta</a> provides several ROP-specific mitigations that extend the protection beyond the simple EAF restriction.</p><p>For ages now, we  have been recommending that companies that use Windows deploy EMET&nbsp; because we realize how much of a low-cost but high-reward  countermeasure it is. If you haven't started already, it is time to <a aiotitle="start a plan to deploy EMET 4.0" href="http://blogs.technet.com/b/srd/archive/2013/04/18/introducing-emet-v4-beta.aspx">start a plan to deploy EMET 4.0</a> in your enterprise.</p>]]>
    </content>
</entry>

<entry>
    <title>Don&apos;t Sign that Applet!</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/04/dont_sign_that_applet.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.158</id>

    <published>2013-04-30T10:19:00Z</published>
    <updated>2013-04-30T10:20:06Z</updated>

    <summary>Hi, it&apos;s Will. I&apos;ve recently been looking into the state of signed Java applet security. This investigation was triggered by the Oracle blog post IMP: Your Java Applets and Web Start Applications Should Be Signed, which as the title implies,...</summary>
    <author>
        <name>Will Dormann</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, it's Will. I've recently been looking into the state of signed Java applet security. This investigation was triggered by the Oracle blog post <a href="https://blogs.oracle.com/java/entry/imp_your_applets_and_web">IMP: Your Java Applets and Web Start Applications Should Be Signed</a>, which as the title implies, suggests that all Java developers sign their applets, regardless of the privileges required. In this blog entry, I explain why this practice is a bad idea.</p>]]>
        <![CDATA[<p>I've blogged about the security aspects of signed Java applets&nbsp;before in&nbsp;<a href="http://www.cert.org/blogs/certcc/2008/06/signed_java_security_worse_tha.html">Signed Java Applet Security: Worse than ActiveX?</a>&nbsp; In that blog post, I explained how signed Java applets are not restricted by the Java sandbox and&nbsp;how the dialogs presented to the user are both confusing and include dangerous default options. Another relevant blog post is&nbsp;<a href="http://www.cert.org/blogs/certcc/2011/06/signed_java_and_cisco_anyconne.html">Signed Java and Cisco AnyConnect</a>. The motivating factor for that post was to describe what happens now that a <a href="http://www.cert.org/blogs/certcc/2011/06/signed_java_and_cisco_anyconne.html">vulnerability</a> has been discovered in the Cisco AnyConnect signed Java applet. In particular, I explained how an attacker could <a href="http://msdn.microsoft.com/en-us/library/aa752035%28v=vs.85%29.aspx#ax_repurposing">repurpose</a> the vulnerable applet to achieve the goal of remote code execution.</p><p>You might be putting the pieces together already:</p><ol><li>Oracle says that all Java applets should be signed.</li><li>Signed Java applets run outside of the&nbsp;Java sandbox.</li><li>Some Java applets have vulnerabilities.</li></ol><p>In the case of an unsigned Java applet, in the absence of a vulnerability in the Java Runtime Environment (JRE)&nbsp;sandbox, vulnerabilities in the applet itself aren't really interesting; that is, if the concept of a vulnerability in a sandboxed applet even makes sense. Right now, if an attacker wants to repurpose a Java applet, it would need to be a signed applet. But what about Oracle's vision of a Java future where every Java applet is signed? What this vision means is that every Java applet, which would be signed, would also now be in a state where it could be repurposed because it&nbsp;is now no longer restricted by the sandbox. A poorly designed sandboxed Java applet can't do much of anything.&nbsp; However, a poorly designed signed Java applet can do pretty much anything that native code can.</p><p>How did Oracle get into this situation?&nbsp;It all goes back to an architectural weakness that has been present in Java since the concept of a signed applet was introduced. Java conflates authentication (&quot;Who wrote this code?&quot;)&nbsp;with authorization (&quot;What is this code allowed to do?&quot;). When you sign an applet, it gets privileges automatically.</p><p>Historically, I believe that it has been well understood that a signed applet is privileged. Or at least, I hope that people understood this. However, Oracle is not taking this aspect into consideration with their guidance to developers to&nbsp;sign all of their applets. Until the aspects of authorization and authentication are properly separated, it will not be safe to sign all applets.</p><p>A Java applet can have an internal JNLP&nbsp;file that specifies the privileges requested by the applet. If no privileges are requested, then the applet is sandboxed. But this situation is only the case if the applet is <a href="http://download.java.net/jdk8/docs/technotes/guides/jweb/deployment_advice.html">launched from a JNLP file</a>. If the applet is launched using an <a href="http://download.java.net/jdk8/docs/technotes/guides/jweb/applet/using_tags.html"><code>&lt;applet&gt;</code>, &lt;<code>object&gt;,</code> or <code>&lt;embed&gt;</code> HTML tag</a>, the applet is given full privileges by default. That's right. JNLP&nbsp;gives sandbox privileges by default, and HTML&nbsp;tags give full privileges by default. We verified that this is the case with Java versions up to and including 7u21.</p><p>In other words, there appears to be no way that a Java applet can be signed and specify that it is only to be executed in a sandbox. The current Java version does not enforce privileges in a way that allows this combination to happen. This challenge&nbsp;is one of the reasons we wrote The CERT Oracle Secure Coding Standard for Java rule <a href="https://www.securecoding.cert.org/confluence/x/NwD1AQ">ENV00-J. Do not sign code that performs only unprivileged operations</a>. Heck, even <a href="http://www.oracle.com/technetwork/java/seccodeguide-139067.html#0-3">Oracle's own guidance</a> states:&nbsp;&quot;For applets and JNLP applications the best approach is often to leave the jar files unsigned.&quot;</p><p>Until this situation is fixed, Java developers should not sign applets that do not need privileges!</p><p>Even once Oracle fixes the JRE to enforce inherently signed-but-sandboxed Java applets, the situation for the end user still leaves something to be desired. With Java 7u21, Oracle has updated the <a href="https://www.java.com/en/download/help/appsecuritydialogs.xml">security dialogs that are presented to the user</a>. In particular, consider the dialog presented before a signed applet runs:</p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img class="mt-image-center" alt="trusted_signed.jpg" width="400" height="243" style="text-align: center; margin: 0px auto 20px; display: block" src="/blogs/certcc/2013/04/27/trusted_signed.jpg" /></span><p>From a security perspective, the difference between a privileged applet and a sandboxed applet is major. But what's the difference in the dialog presented to the user?</p><p><strong>Privileged:</strong> <em>The application will run with unrestricted access which may put your computer and personal information at risk.</em></p><p><strong>Sandboxed:</strong> <em>The application will run with restricted access that is intended to protect your computer and personal information.</em></p><p>How thoroughly do most home users read text in dialog boxes that are presented to them? Given that the other aspects of the dialog are the same, is the difference between <em>restricted</em> and <em>unrestricted</em> obvious enough to let the user know the impact of the decision they are about to make?</p><p>As we have <a href="http://www.cert.org/blogs/certcc/2013/01/java_in_web_browser_disable_no.html">mentioned before</a>, if you don't need Java in your web browser, <a href="http://www.java.com/en/download/help/disable_browser.xml">turn it off</a>. If you don't know if you need Java in your web browser, turn it off anyway and see what breaks. You might find that it doesn't affect you at all.</p><p>&nbsp;</p>]]>
    </content>
</entry>

<entry>
    <title>Finding Patterns of Malicious Use in Bulk Registrations</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/04/finding_patterns_of_malicious.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.157</id>

    <published>2013-04-24T12:14:00Z</published>
    <updated>2013-04-24T12:49:49Z</updated>

    <summary><![CDATA[Hi, this is Leigh Metcalf with my colleague Jonathan Spring. In 2011, .co.cc&nbsp;[1] and .co.tv&nbsp;[2] were removed from Google&rsquo;s search results because of the high incidence of malicious domains (.cc is the TLD for the Cocos Islands and .tv is...]]></summary>
    <author>
        <name>Leigh Metcalf</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Leigh Metcalf with my colleague Jonathan Spring. In 2011, .co.cc&nbsp;<a href="http://www.theregister.co.uk/2011/07/06/google_cans_11m_dot_co_dot_cc_sites/">[1]</a> and .co.tv&nbsp;<a href="https://www.syndk8.com/news/first-co-cc-now-google-banned-co-tv-0001246.html">[2]</a> were removed from Google&rsquo;s search results because of the high incidence of malicious domains (.cc is the TLD for the Cocos Islands and .tv is the TLD for Tuvalu). Neither of these domains is an official TLD of its respective country of origin, but is a zone in which the owner happens to make single subdomains freely available and charge a nominal fee for bulk registrations. Similarly, an APWG report for the second half 2011 lists .tk, the TLD of the island of Tokulu, as the most common TLD used in phishing attacks. It also permits free domain registration.</p>]]>
        <![CDATA[<p>Our goal is to look for patterns of (malicious) use in free and bulk registrations effective TLDs (eTLD). For this task, we use a passive DNS data source, the SIE (<a href="http://sie.isc.org">http://sie.isc.org</a>). Figure 1 shows the number of unique subdomains resolved in .co.cc from January 1 through December 31 of 2012. Figure 2 displays the same data but for .co.tv, and Figure 3 likewise displays data for .tk.</p>
<p>
<span class="mt-enclosure mt-enclosure-image" style="display: inline">
    <img class="mt-image-left" alt="copy.png" width="600" height="489" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/04/24/copy.png" />
</span>
</p>
<p>Figure 1</p>
<p>The .co.cc results spike on May 17, 2012 to almost double of any other peak during the year. The IP address used by the domains on that are peculiar; 47% of the domains (about 69,000) pointed to just four IP addresses. All four of which are listed on popular blacklists as malware distribution locations as well as spam hosts and senders.<o:p></o:p></p>
<p class="MsoNormal" style="margin: 0in 0in 10pt">In the .co.tv graphic, there is a spike in the number of active domains on October 6, 2012. The domains in this spike likewise had curious IP use. Of these 124,864 domains, 98% of them pointed to a single IP address, which is listed by SpyEye tracker as a known command and control IP, and is listed elsewhere as a known phishing IP, malware distributor, and spammer. The number of domains (124,864) is also about 45 times the median number of unique resolved domains for .co.tv for 2012 (2,824), which means the usual number of domain names make up the other 2% on that day.<o:p></o:p></p>
<p>
<span class="mt-enclosure mt-enclosure-image" style="display: inline">
    <img class="mt-image-left" alt="tv .png" width="600" height="489" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/04/24/tv%20.png" />
</span>
</p>
<p>Figure 2</p>
<p>The .tk TLD demonstrates similar spikes, namely on May 21, 2012. In this case, approximately 81% of the domains resolved to only 2 IP addresses. Again, both of these IP addresses are on external blacklists as being related to Zeus, SpyEye, and other malicious activity.</p>
<p>
<span class="mt-enclosure mt-enclosure-image" style="display: inline">
    <img class="mt-image-left" alt="tk.png" width="600" height="489" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/04/24/tk.png" />
</span>
</p>
<p>Figure 3</p>
<p>As demonstrated in our previous blog post, the popular and respected generic TLDs do not exhibit such extreme behavior (the scales of the charts are not equivalent). These three cases indicate that these peculiar bursts of activity are malicious in nature. There are too many smaller jumps throughout the year to investigate all of them; however, they appear to largely be microcosms of the larger bursts, which are generally malicious.</p>
<p>Despite such high-profile efforts as Google&rsquo;s delisting effort, the .co.tv eTLD is still active and is still hosting bursts of malicious domains. There was a lull at the end of 2012, but activity resumes in 2013 (not pictured). These bursts are likely correlated with important campaigns for the domain owners. Examples might be upgrading malicious software or delivering particularly important commands. We are not able to positively identify these actions explicitly with passive DNS data. Such bulk activation largely defeats domain block list efforts since there are too many individual domains. The .co.tv and .tk domains remain dangerous to the internet community because they allow these sorts of bulk registrations.</p>
<p>The .co.cc eTLD is another story. On November 13-14 2012, it precipitously disappeared. There have been no more than a handful of .co.cc domains with IP addresses, and all are name servers in glue records that do not come from the official .co.cc name server. The zone is dead; as of this writing, it remains so. Slashdot reported on this situation at the time &lt;<a href="http://tech.slashdot.org/story/12/11/15/2215256/free-registrar-cocc-goes-the-way-of-the-dodo">http://tech.slashdot.org/story/12/11/15/2215256/free-registrar-cocc-goes-the-way-of-the-dodo</a>&gt;, including the remark that .tk was available to replace any free domain needs the user had. There does not seem to be any technical reason for the cessation of operations. We believe this emphasizes the need for non-technical solutions to the other related problem areas. Send your comments to <a href="mailto:netsa-contact@cert.org">netsa-contact@cert.org</a>.</p>]]>
    </content>
</entry>

<entry>
    <title> GeoIP in Your SOC (Security Operations Center)  </title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/04/geoip_in_your_soc_security_ope.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.155</id>

    <published>2013-04-17T14:44:00Z</published>
    <updated>2013-04-17T14:48:10Z</updated>

    <summary><![CDATA[Hi, this is Vijay Sarvepalli, Security Solutions Engineer in the CERT Program. Today, whether you&rsquo;re shopping for a new house or trying to find a babysitter, you end up using Google maps or a similar service to assist your decision...]]></summary>
    <author>
        <name>Vijay Sarvepalli</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Vijay Sarvepalli, Security Solutions Engineer in the CERT Program. Today, whether you&rsquo;re shopping for a new house or trying to find a babysitter, you end up using Google maps or a similar service to assist your decision making. In this blog post, I discuss GeoIP capabilities that can be built into your SOC to provide a spatial view of your network threats and how this view can help your network situational awareness.</p>]]>
        <![CDATA[<p>On a late Friday night, one of my friends who is a senior systems administrator at an ISP told me about a large DDOS (Distributed Denial of Service) attack against his company&rsquo;s web servers. The DDOS was starting to bog down his web server and a number of network resources. Abandoning my promise to get home early, I started digging into this incident and found it was a well-distributed denial of service. A completely random set of IP addresses were flooding the network with a random POST request on the root directory (see sample apache log below):</p><p><strong><em>XX.XX.251.19 - - [29/Sep/2012:03:10:05 -0500] &quot;POST /?ptrxcz_YYYYYZZZZZZZaaaaaaabbbbbbbbccc HTTP/1.1&quot; 301 271</em></strong></p><p>The more I analyzed the problem, the more interesting it became. My initial analysis found that the attack involved about 1.3 million IP addresses. I went down the path of researching these networks and found that 19,637 unique class B (/16 subnet) networks were involved in the attack. After searching through ASNs (Autonomous System Numbers) of these attacking networks, I found that 15,723 unique ASNs were involved in the attack. Each web request had its own unique properties at both the packet level and application level (unique User-Agent strings for example).</p><p>I reached out to my colleague Evan Wright, a security analyst, to help solicit ideas to process this data. The more we talked, the more it became clear that my network situational awareness could benefit from a geospatial perspective. I quickly began using <a target="_blank" href="http://www.maxmind.com">MaxMind&rsquo;s</a> opensource GeoIP data to analyze the latitude and longitude geospatial locations of these IP addresses. Over 33,500 unique locations were represented, however there were concentrations of the attackers' geospatial locations.</p><p>Evan whipped up a quick heat map of the attacker's network; soon enough we had a different view of the attack. The attackers almost exclusively were in developing countries. The highest concentration of attackers was in Egypt and its neighboring countries. There were also substantial concentrations of attackers in India, Thailand, Venezuela, and parts of Argentina.</p><p>Here is a modified version of that heat map:</p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img alt="S-Shot1.png" width="600" height="445" src="/blogs/certcc/S-Shot1.png" /></span><p>I&nbsp;presented this information back to my friend at the ISP who was able to build a black hole for certain groups of networks and minimize the impact of the attack. Like most ISPs that don&rsquo;t have enterprise-level tools, the ISP benefited from a SOC geospatial view of the situation. The ISP was able to further investigate and discover possible attribution for this attack. While the attack is still ongoing (see recent sample logs below), the ISP can now gain a geospatial understanding of this attack and work towards mitigation.</p><p><strong><em>XX.XX.212.118 - - [15/Apr/2013:09:27:10 -0500] &quot;POST /?ptrxcz_9CEGJLNPSTVYacegjloqsuwz13579B HTTP/1.1&quot; 301 271 </em></strong></p><p>After experience with this attack, I have built a few more tools that can be present in a SOC to help visualize and use GeoIP data to better assist the analysis of network threats. These tools include the following:</p><ol><li>A simple GeoIP plotter that displays markers on a map to identify IP addresses. Simply plot an IP address and drill down on details of an IP address as shown below:</li></ol><p><img alt="S-Shot2.png" width="600" height="408" src="/blogs/certcc/S-Shot2.png" /></p><ol start="2"><li>A heat-map tool that can build a heat map of large set of IP addresses. The heat map below shows a recent DDOS attack on Spamhaus from open resolvers:</li></ol><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img alt="S-Shot3.png" width="600" height="427" src="/blogs/certcc/S-Shot3.png" /></span><ol start="3"><li>A simulated heat-map that can animate the heat map to display netflow data. The map looks similar to the previous plot, but shows changes through time.</li></ol><ol start="4"><li>An interactive cluster map with clusters of networks associated with the provided IP addresses. Cluster maps dynamically reallocate bins of data at each zoom level. The cluster map below shows about 1.6 million IP addresses that were part of a DNS DDOS attack:</li></ol><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img alt="S-Shot4.png" width="600" height="351" src="/blogs/certcc/S-Shot4.png" /></span><p>In any SOC, a geospatial toolkit can be used to rapidly answer questions such as</p><ul><li>Where is the attacker located?</li><li>How distributed is the attack?</li><li>What possible mitigations can be made knowing the attack&rsquo;s geospatial view?</li></ul><p>Do you have more use cases? To what extent is geographical churn present, indicating IP fluxing? Send your comments and ideas to <a href="mailto:netsa-contact@cert.org">netsa-contact@cert.org</a>.</p>]]>
    </content>
</entry>

<entry>
    <title>Second Level Domain Usage in 2012 for Common Top Level Domains</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/04/sld_usage_in_2012_for_common_t.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.154</id>

    <published>2013-04-04T19:04:00Z</published>
    <updated>2013-04-04T20:33:04Z</updated>

    <summary>Hi, this is Leigh Metcalf with my colleague Jonathan Spring. Here is a look at second level domain (SLD) usage in 2012 for the most common generic Top Level Domains (gTLDs): biz, com, info, mobi, net, and org. We used...</summary>
    <author>
        <name>Leigh Metcalf</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Leigh Metcalf with my colleague Jonathan Spring. Here is a look at second level domain (SLD) usage in 2012 for the most common generic Top Level Domains (gTLDs): biz, com, info, mobi, net, and org. We used two data sources: (1)the master zone files (RFC 1035 sec. 5) and (2) the SIE (<a href="http://sie.isc.org">http://sie.isc.org</a>), a passive DNS data source. From these sources we examined three features of global gTLD usage&mdash;the number registered, the number active, and the ratio.</p>]]>
        <![CDATA[<p>Table 1 shows stats about domains registered in 2012 from zone file analysis. Start and End are the number of SLDs in each zone file at the start and end of 2012, respectively. Max is the largest number of unique SLDs in the zone file we observed on a day throughout the year.</p><div align="center"><table border="1" cellspacing="0" cellpadding="0"><tbody><tr><td valign="top"><small><br /><strong>TLD</strong></small></td><td valign="top"><p><small><strong>Start</strong></small></p></td><td valign="top"><p><small><strong>End</strong></small></p></td><td valign="top"><p><small><strong>Average</strong></small></p></td><td valign="top"><p><small><strong>Date of Max</strong></small></p></td><td valign="top"><p><small><strong>Max</strong></small></p></td></tr><tr><td valign="top"><p><small>biz</small></p></td><td valign="top"><p><small>2,175,697</small></p></td><td valign="top"><p><small>2,276,104</small></p></td><td valign="top"><p><small>2,240,193.5</small></p></td><td valign="top"><p><small>2012-11-15</small></p></td><td valign="top"><p><small>2,281,118</small></p></td></tr><tr><td valign="top"><p><small>com</small></p></td><td valign="top"><p><small>99,303,617</small></p></td><td valign="top"><p><small>106,876,588</small></p></td><td valign="top"><p><small>103,329,433.9</small></p></td><td valign="top"><p><small>2012-12-31</small></p></td><td valign="top"><p><small>106,876,588</small></p></td></tr><tr><td valign="top"><p><small>info</small></p></td><td valign="top"><p><small>8,221,272</small></p></td><td valign="top"><p><small>7,047,407</small></p></td><td valign="top"><p><small>7,743,564.8</small></p></td><td valign="top"><p><small>2012-01-31</small></p></td><td valign="top"><p><small>8,269,131</small></p></td></tr><tr><td valign="top"><p><small>mobi</small></p></td><td valign="top"><p><small>1,011,381</small></p></td><td valign="top"><p><small>1,041,155</small></p></td><td valign="top"><p><small>1,033,351.4</small></p></td><td valign="top"><p><small>2012-04-13</small></p></td><td valign="top"><p><small>1,046,251</small></p></td></tr><tr><td valign="top"><p><small>net</small></p></td><td valign="top"><p><small>14,363,672</small></p></td><td valign="top"><p><small>14,965,672</small></p></td><td valign="top"><p><small>14,721,459.3</small></p></td><td valign="top"><p><small>2012-12-31</small></p></td><td valign="top"><p><small>14,965,672</small></p></td></tr><tr><td valign="top"><p><small>org</small></p></td><td valign="top"><p><small>9,666,025</small></p></td><td valign="top"><p><small>10,166,747</small></p></td><td valign="top"><p><small>9,983,061.1</small></p></td><td valign="top"><p><small>2012-12-31</small></p></td><td valign="top"><p><small>10,166,474</small></p></td></tr></tbody></table></div><p>Table 1</p><p>The com, net, and org domains all increased through the year. The biz and mobi domains also showed gains, but not consistently. The info TLD consistently shrunk. However, just because a domain is in a zone file doesn&rsquo;t mean that anyone is actually using it. To determine level of use, we looked at what domains were resolved; for this analysis, we turned to the SIE and measurements of unique active domains per day (0000-2359 UTC) during 2012. <br />From the SIE database we considered the average number of unique second-level domains resolved per day and the growth rate through the year (see Table 2). This value is bounded by the zone file contents since only domains in the zone file can be resolved; but the value is also is heavily influenced by other factors.</p><table border="1" cellspacing="0" cellpadding="0"><tbody><tr><td valign="top" width="128"><br /><small><strong>TLD</strong></small></td><td valign="top" width="115"><p><small><strong>Start</strong></small></p></td><td valign="top" width="115"><p><small><strong>End</strong></small></p></td><td valign="top" width="144"><p><small><strong>Average</strong></small></p></td><td valign="top" width="137"><p><small><strong>Growth Rate</strong></small></p></td></tr><tr><td valign="top" width="128"><p><small>biz</small></p></td><td valign="top" width="115"><p><small>80,167</small></p></td><td valign="top" width="115"><p><small>71,257</small></p></td><td valign="top" width="144"><p><small>93,451.8</small></p></td><td valign="top" width="137"><p><small>-11.1%</small></p></td></tr><tr><td valign="top" width="128"><p><small>com</small></p></td><td valign="top" width="115"><p><small>10,284,693</small></p></td><td valign="top" width="115"><p><small>9,287,419</small></p></td><td valign="top" width="144"><p><small>10,990,617</small></p></td><td valign="top" width="137"><p><small>-9.7%</small></p></td></tr><tr><td valign="top" width="128"><p><small>info</small></p></td><td valign="top" width="115"><p><small>326,843</small></p></td><td valign="top" width="115"><p><small>206,897</small></p></td><td valign="top" width="144"><p><small>283,529.1</small></p></td><td valign="top" width="137"><p><small>-36.7%</small></p></td></tr><tr><td valign="top" width="128"><p><small>mobi</small></p></td><td valign="top" width="115"><p><small>8,202</small></p></td><td valign="top" width="115"><p><small>8,858</small></p></td><td valign="top" width="144"><p><small>10,358.8</small></p></td><td valign="top" width="137"><p><small>8%</small></p></td></tr><tr><td valign="top" width="128"><p><small>net</small></p></td><td valign="top" width="115"><p><small>7,763,538</small></p></td><td valign="top" width="115"><p><small>998,950</small></p></td><td valign="top" width="144"><p><small>1,198,016.8</small></p></td><td valign="top" width="137"><p><small>-14.2%</small></p></td></tr><tr><td valign="top" width="128"><p><small>org</small></p></td><td valign="top" width="115"><p><small>1,041,970</small></p></td><td valign="top" width="115"><p><small>941,262</small></p></td><td valign="top" width="144"><p><small>1,130,457.8</small></p></td><td valign="top" width="137"><p><small>-9.7%</small></p></td></tr></tbody></table><p>Table 2</p><p>Despite of the growth in zone file size, the number of unique SLDs resolved per day decreased. There are spikes in the number, some of which can be attributed to measurement volatility; however, the general trend downward does not seem to be due to measurement error. Especially in the case of the info domain, it is interesting to ask if the large changes in zone file size effected the percentage of domains from the zone that were resolved per day. Figure 1 displays the percentage of domains in the gTLD zone files that were resolved every day during 2012.</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img class="mt-image-left" alt="domains1.png" width="600" height="360" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/04/03/domains1.png" /></span></p><p>Figure 1</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><a onclick="window.open('/blogs/certcc/2013/04/03/domains1%20large.html','popup','width=833,height=500,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/04/03/domains1%20large.html">View a larger&nbsp;version of Figure 1</a></span></p><p>These lines are not smooth, due to both natural weekly and daily usage cycles and some other more curious spikes. Using time series analysis, we examined the underlying trend and extracted these cyclical patterns and one-time spikes. Figure 2 illustrates the trend without these factors. Note that the Y axis scale changes from 0-18% to 0-14%. The trend is distinctly downward, with the exception of the mobi domain, which remains approximately constant.</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img class="mt-image-left" alt="domains2.png" width="600" height="360" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/04/03/domains2.png" /></span></p><p>Figure 2</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><a onclick="window.open('/blogs/certcc/2013/04/03/domains2-large.html','popup','width=833,height=500,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/04/03/domains2-large.html">View a larger version of Figure 2</a></span></p><p>As you can see, despite the increase in the number of domains that are registered in the official registries, the number of SLDs that are active each day has decreased during the course of the year, both in absolute terms and as a percentage of the domains in the zone file. We have not yet determined a causal explanation for this phenomenon, so comments are welcome. Send your comments to <a href="mailto:netsa-contact@cert.org">netsa-contact@cert.org</a>.</p>]]>
    </content>
</entry>

<entry>
    <title>The Growth of IPv6 Announcements</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/03/the_growth_of_ipv6_announcemen.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.153</id>

    <published>2013-03-27T12:39:00Z</published>
    <updated>2013-03-27T12:39:27Z</updated>

    <summary><![CDATA[Hi, this is Leigh Metcalf again with my colleague Rhiannon Weaver. IPv6, the replacement for IPv4, has been heavily marketed.&nbsp; To consider exactly how popular IPv6 is on the internet, one method is to examine the number of autonomous systems...]]></summary>
    <author>
        <name>Leigh Metcalf</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Leigh Metcalf again with my colleague Rhiannon Weaver. IPv6, the replacement for IPv4, has been heavily marketed.&nbsp; To consider exactly how popular IPv6 is on the internet, one method is to examine the number of autonomous systems (ASes) that announce IPv6.&nbsp;</p>]]>
        <![CDATA[<p>Using the data available from Routeviews (<a href="http://routeviews.org">http://routeviews.org</a>) and RIPE (<a href="http://ripe.net">http://ripe.net</a>), we counted the number of ASes that announced IPv6 from January 1, 2004 through mid-February of&nbsp;2013. Figure 1 displays&nbsp;the number of ASes announced as well as&nbsp;important dates in the history of IPv6.</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img class="mt-image-left" alt="figure1.png" width="600" height="354" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/03/26/figure1.png" /></span></p><p>Figure 1</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><a onclick="window.open('/blogs/certcc/2013/03/27/figure1-large.html','popup','width=833,height=491,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/03/27/figure1-large.html">View a larger version of Figure 1</a></span></p><p>&nbsp;To analyze this curve, the data was split into five groups as shown in Figure 2.&nbsp; The gap in time between Group 1 and Group 2 is due to a data collection issue.&nbsp; The trend for each group was modeled as an exponential growth curve. The growth rates listed in Table 1 show the expected percent growth of the number of announcements in one month&rsquo;s time (31 days), given the general trend at the time for the group.</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline">&nbsp;</span><table border="0" cellspacing="0" cellpadding="0" width="100%"><tbody><tr><td bgcolor="#cccccc" valign="top" align="center"><strong>Group</strong></td><td bgcolor="#cccccc" valign="top" align="center"><strong>Date Range</strong></td><td bgcolor="#cccccc" valign="top" align="center"><strong>Expected Monthly Growth (% Increase)</strong></td></tr><tr><td align="center">1</td><td align="center">01/01/2004 - 07/05/2007</td><td align="center">1.5%</td></tr><tr><td align="center">2</td><td align="center">01/01/2008 - 07/01/2010</td><td align="center">3.8%</td></tr><tr><td align="center">3</td><td align="center">07/05/2010 - 06/05/2011</td><td align="center">5.4%</td></tr><tr><td colspan="3" align="center"><hr size="1" /></td></tr><tr><td align="center">4</td><td align="center">06/10/2011 - 12/31/2012</td><td align="center">2.4%</td></tr><tr><td colspan="3" align="center"><hr size="1" /></td></tr><tr><td align="center">5</td><td align="center">01/01/2013 - 02/19/2013</td><td align="center">2.9%</td></tr><tr><td colspan="3" align="center"><hr size="1" /></td></tr></tbody></table>Table 1</p><p>The fastest growth period was the time between July 2010 and June 2011, when the number of ASes announcing IPv6 space grew by 5.4% on average.&nbsp;</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><img class="mt-image-left" alt="figure2.png" width="600" height="354" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/03/27/figure2.png" /></span>Figure 2</p><p><span class="mt-enclosure mt-enclosure-image" style="display: inline"><a onclick="window.open('/blogs/certcc/2013/03/27/figure2-large.html','popup','width=833,height=491,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/03/27/figure2-large.html">View a larger version of Figure 2</a></span></p><p>If that growth rate&nbsp;continued through the end of 2011 through 2013, we would expect to see approximately 12,500 ASes announcing IPv6 addresses as of March 1st, 2013. However, after the announcement of <a href="http://www.worldipv6day.org/faq/">World IPv6 day </a>in June 2011, the rate of growth in IPv6 announcements among ASes started to decline.</p><p>The numbers are still increasing, but the number of announcements in late February and early March 2013 was closer to 7,000, as opposed to the 12,500 predicted by the group 3 growth rate. If the current growth rate of 2.9% increase per month continues, we could expect the number of Autonomous Systems advertising IPv6 space to double to around 14,000 in approximately 25 months (April 1st, 2015). However, as the graph indicates, the recent growth rates do not appear stable for more than approximately 18 months and may see another shift in that time.</p>]]>
    </content>
</entry>

<entry>
    <title>An Alternate View of Announced IPv4 Space</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/03/an_alternate_view_of_announced.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.152</id>

    <published>2013-03-21T14:18:00Z</published>
    <updated>2013-03-22T15:02:15Z</updated>

    <summary><![CDATA[In my previous post, I examined the total amount of IPv4 space announced and presented cumulative graphics.&nbsp; While this view is useful in determining how much IPv4 space is announced, it doesn&rsquo;t say much about which IPv4 space is announced.&nbsp;...]]></summary>
    <author>
        <name>Leigh Metcalf</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>In my previous post, I examined the total amount of IPv4 space announced and presented cumulative graphics.&nbsp; While this view is useful in determining how much IPv4 space is announced, it doesn&rsquo;t say much about which IPv4 space is announced.&nbsp; The graphic in Figure 1 is an alternate visualization of the data from that post and is called the Internet barcode.</p>]]>
        <![CDATA[<p>&nbsp;<img class="mt-image-left" alt="iheat.png" width="600" height="360" style="margin: 0px 20px 20px 0px; float: left" src="/blogs/certcc/2013/03/13/iheata.png" /></p>
<p>&nbsp;Figure 1</p>
<span class="mt-enclosure mt-enclosure-image" style="display: inline">
    <a onclick="window.open('/blogs/certcc/2013/03/13/iheat-large.html','popup','width=833,height=500,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/03/13/iheat-large.html">[view a larger version of Figure 1]</a>
</span>
<p>&nbsp;On the left side of the graphic I have listed the 256 /8 CIDR blocks found in IPv4 space. Each /8 has a horizontal line where the darkness of the line corresponds to the amount of that /8 that is announced.&nbsp; As with the previous post, the data covers the time period between January 1, 2009 and December 31, 2012.</p>]]>
    </content>
</entry>

<entry>
    <title>The Growth Rate of IP Addresses That Are Advertised as Usable on the Internet</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/03/_v_behaviorurldefaultvml_o_beh.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.150</id>

    <published>2013-03-13T17:12:00Z</published>
    <updated>2013-03-14T17:27:45Z</updated>

    <summary>Hi, this is Leigh Metcalf of the Network Situational Awareness Team. Recently, I have been considering the amount of IPv4 space that is announced on the Internet. All blocks have been allocated, but how many are actually being used? To...</summary>
    <author>
        <name>Leigh Metcalf</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Leigh Metcalf of the Network Situational Awareness Team. Recently, I have been considering the amount of IPv4 space that is announced on the Internet. All blocks have been allocated, but how many are actually being used? To investigate this, I examined the routing tables to determine which networks were announced on the internet as usable from January 1, 2009 through December 31, 2012.</p>]]>
        <![CDATA[<p>I used the data available from Routeviews (<a href="http://routeviews.org/">http://routeviews.org</a>) and RIPE (<a href="http://ripe.net/">http://ripe.net/</a>). These data were collected from 22 sources sharing the routing tables of 621 routers located throughout the world. The percentage of new IP address space announced is computed by taking the total announcements for the day, removing any reserved IP space that is announced, and then dividing that total by the total number of IP space available. The number of available IPs is calculated using the entire IPv4 space minus the reserved IP space.</p>
<p>I will be refining the results throughout this post, but Figure 1 illustrates the initial results.</p>
<p>&nbsp;</p>
<span class="mt-enclosure mt-enclosure-image" style="display: inline;">
    <img width="600" height="450" alt="results.png" src="/blogs/certcc/2013/03/11/results.png" class="mt-image-left" style="float: left; margin: 0 20px 20px 0;" />
</span>
<p>Figure 1<br />
<a href="/blogs/certcc/2013/03/11/results-large.html" onclick="window.open('/blogs/certcc/2013/03/11/results-large.html','popup','width=833,height=625,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false">[view a larger version of Figure 1]</a></p>
<p>&nbsp;</p>
<p>Figure 1 was a bit out of sorts, so I examined the data closely. Upon further investigation, I determined that one autonomous system (AS) in particular tended to announce very large networks it did not own. Figure 1 was created with no filter and this AS data skewed the results. Therefore, the counts were redone with the misbehaving networks removed from the computation. The result was Figure 2.</p>
<span style="display: inline" class="mt-enclosure mt-enclosure-image">
    <img width="600" height="450" src="/blogs/certcc/2013/03/11/results-2.png" style="margin: 0px 20px 20px 0px; float: left" alt="results-2.png" class="mt-image-left" />
</span>
<p>&nbsp;</p>
<p>Figure 2<br />
<span style="display: inline;" class="mt-enclosure mt-enclosure-image">
    <a onclick="window.open('/blogs/certcc/2013/03/11/results-2-large.html','popup','width=833,height=625,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/03/11/results-2-large.html">[view a larger version of Figure 2]</a>
</span></p>
<p>&nbsp;</p>
<p>There was still quite a bit of churn displayed in Figure 2, represented by minor spikes and plateaus. Therefore, I examined the results, in particular during the dates of the spikes. Several AS data sources were discovered to be announcing networks they should not have announced. While not as egregious as the first AS, the additional announcements were removed. Thus, the more accurate Figure 3 resulted. Note the change in vertical scale.</p>
<span style="display: inline" class="mt-enclosure mt-enclosure-image">
    <img width="600" height="450" src="/blogs/certcc/2013/03/11/results-3.png" style="margin: 0px 20px 20px 0px; float: left" alt="results-3.png" class="mt-image-left" />
</span>
<p>&nbsp;</p>
<p>Figure 3<br />
<span style="display: inline;" class="mt-enclosure mt-enclosure-image">
    <a onclick="window.open('/blogs/certcc/2013/03/11/results-3-larger-a.html','popup','width=833,height=625,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false" href="/blogs/certcc/2013/03/11/results-3-larger-a.html">[view a larger version of Figure 3]</a>
</span></p>
<p>While not a perfect view, Figure 3 demonstrates the gradual growth of the announced IP space versus the space available to be announced since January 1, 2009 through the end of 2012.</p>
<p>This analysis demonstrates that advertised address space grows at an average of 6.7% per year. The data fit a line to it with a slope of 0.0116 and an intercept of 50.62 with a RSS of 0.977.</p>]]>
    </content>
</entry>

<entry>
    <title>Watching Domains That Change DNS Servers Frequently</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/03/watching_domains_that_change_d.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.149</id>

    <published>2013-03-11T13:04:33Z</published>
    <updated>2013-03-11T13:09:51Z</updated>

    <summary>Hello, this is Leigh Metcalf of the CERT Network Situational Awareness (NetSA) Team. Timur Snoke and I have discovered some interesting results in our continuing examination of the public Domain Name System (DNS). Our work has been focusing on domains...</summary>
    <author>
        <name>Timur Snoke</name>
        
    </author>
    
        <category term="Analysis" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Research" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hello, this is Leigh Metcalf of the CERT <a href="http://www.cert.org/netsa/">Network Situational Awareness (NetSA) Team</a>. Timur Snoke and I have discovered some interesting results in our continuing examination of the public Domain Name System (DNS). Our work has been focusing on domains that change their name servers frequently.</p>]]>
        <![CDATA[<p>In the DNS, a domain only exists once it has been registered with the TLD (top-level domain) registry and the name servers to which it is assigned are operational. Logically, the entity that registers the pairing of domain to name server and the entity that operates a name server are distinct, although they are often the same. A domain may be purchased from a registration authority, which may also host the name servers to which the name is assigned. Many times the resolution authority and the registration authority are one and the same. If they aren't the same, then the administrator of the domain must both provide updates to the zone file&mdash;to point to the correct name servers&mdash;and ensure that the servers operate correctly.</p>
<p>Changing name servers generally causes disruptions. Regardless of the authority structure, for stability and robustness, the standard configuration is to use multiple name servers but not to change name servers often. This is a feature that's often taken for granted by end-users in today's Internet since DNS operators have had such practice in the tricky handovers.</p>
<p>Using a public source of passively collected DNS resolutions, we were able to find a collection of domains that frequently changed name servers over a period of 3 months. A domain changing name servers once or twice during 3 months is likely not suspicious; such behavior is probably due to reasonable hosting and operational changes. In our analysis, we found over 2,400 domains that exhibited name server instability. Figure 1 displays the distribution of the number of times a domain changed its name server, ranging from 3 to 16 times.</p>
<p><img class="mt-image-none" alt="Figure 1: Number of Times Domains Changed Name Servers" width="450" height="338" src="/blogs/certcc/2013/03/07/domains-changing-nameservers.png" /><br />
<i>Figure 1: Distribution of the Number of Times Domains Changed Name Servers </i></p>
<p>Conceptually this is suspicious because only domains that try to hide need to be on the run, to stretch a metaphor, from name server to name server. We studied the various domains that exhibited this behavior, and our examination of the top offenders yielded domains exhibiting unsavory behavior such as hosting malware, pornography, unlicensed pharmacology sales, and hacked domains. The domains that changed name servers frequently were not necessarily malicious; however, all displayed some unsavory characteristic, and this behavior may foreshadow additional malicious behavior. In short, our study yielded a list of suspicious domains that should be examined or monitored.</p>
<p>A possible explanation for these changes in resolution name server and why such changes are linked to unsavory behavior is that changing name servers may be due to provider reassignment. If a domain provides unsavory content, it may constantly be forced to relocate by its providers. Although we have no visibility into such details, it's our best guess as to why this suspicious name server behavior is correlated with such unsavory types of domains.</p>
<p>Going forward, we can't determine if this practice will become more or less widespread. However, it's behavior that's occurring in the wild. Since there's a correlation between moving name servers and unsavory behavior, we suggest that people take similar measures to identify and watch such domains.</p>]]>
    </content>
</entry>

<entry>
    <title>Anatomy of Java Exploits</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/01/anatomy_of_java_exploits.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.136</id>

    <published>2013-01-15T19:00:00Z</published>
    <updated>2013-01-15T19:01:02Z</updated>

    <summary><![CDATA[On behalf of the real author, my colleague David Svoboda (and a couple others who work on the CERT Secure Coding Initiative), here's a post analyzing recent Java exploits.Java was exploited recently and&nbsp;last August.&nbsp; The August exploit was patched by...]]></summary>
    <author>
        <name>Art Manion</name>
        
    </author>
    
        <category term="Secure Coding" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>On behalf of the real author, my colleague David Svoboda (and a couple others who work on the <a href="http://www.cert.org/secure-coding/">CERT Secure Coding Initiative</a>), here's a post analyzing recent Java exploits.</p><p>Java was exploited <a href="http://www.kb.cert.org/vuls/id/636312">recently</a> and&nbsp;<a href="http://www.kb.cert.org/vuls/id/636312">last August</a>.&nbsp; The August exploit was <a href="http://www.oracle.com/technetwork/java/javase/downloads/jre7u7-downloads-1836441.html">patched</a> by Oracle on August 30; this most recent exploit now also has a <a href="http://www.oracle.com/technetwork/java/javase/7u11-relnotes-1896856.html">patch</a> available. Strictly speaking, the vulnerabilities that permitted both exploits are independent; the current exploit attacked code that was unused by the August exploit. Nevertheless, these vulnerabilities were quite similar.&nbsp; This blog post examines the vulnerabilities that permitted Java to be exploited in each case, using the proof-of-concept code exploits that have been published for them in <a href="http://pastebin.com/cUG2ayjh">January 2013</a> and <a href="http://www.metasploit.com/modules/exploit/multi/browser/java_jre17_exec">August 2012</a>.</p>]]>
        <![CDATA[<p><strong>Background</strong><br /><br />Unlike most languages, Java was specifically designed for <a href="http://docs.oracle.com/javase/tutorial/security/index.html">safe execution of untrusted code</a>. Although the security API involves many classes, the <a href="http://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html">SecurityManager</a> class is the most critical. The <a href="http://docs.oracle.com/javase/7/docs/api/java/lang/System.html">System</a> class contains a single static instance of the SecurityManager class. The SecurityManager monitors certain potentially sensitive actions, and causes a SecurityException to be thrown when the program attempts to perform an action for which it lacks permissions. The System.SecurityManager can also be set to null, in which case all actions are permitted. Typical sensitive actions checked by the SecurityManager include the execution of other applications, opening of local files, opening network sockets, and loading additional Java code.&nbsp; The SecurityManager also prevents untrusted code from changing certain system settings, including disabling the SecurityManager.<br /><br />Most Java desktop applications run with the null SecurityManager; consequently Java applications&nbsp; can perform the same functions permitted by a program written in any other language in the same context.&nbsp; A non-null security manager enforces a security policy put in place for the Java code that is running. For&nbsp; Java applets, there is a restrictive security policy. This security policy prevents applets from opening local files or network sockets, with the exception that applets may open a connection to the web address from which they originated. Colloquially, they are permitted to &ldquo;phone home.&rdquo; In theory, it is possible to run Java applets from an untrusted source, while preventing the untrusted code from contacting other untrusted websites or tampering with local files.&nbsp; This level of security helped to propel Java applets into widespread use when they were first introduced in 1995.<br /><br />The recent exploits demonstrate that the Java environment fails to achieve its theoretical security potential. Both exploits can be run as applets. They each work in the context of a SecurityManager and they each manage to disable the security manager to run arbitrary code.<br /><br />Writing secure Java code can be nontrivial. This is especially true if the code interacts with untrusted code, or otherwise depends on Java's security architecture. To assist developers in writing secure code, CERT has published <em><a href="http://www.informit.com/store/cert-oracle-secure-coding-standard-for-java-9780321803955">The CERT Oracle Secure Coding Standard for Java</a></em> (the <a href="https://www.securecoding.cert.org/confluence/display/java/The+CERT+Oracle+Secure+Coding+Standard+for+Java">rules</a> are also available).&nbsp;Sun also published its own secure coding <a href="http://www.oracle.com/technetwork/java/seccodeguide-139067.htmlhttp:/www.oracle.com/technetwork/java/seccodeguide-139067.html">rules for Java</a>; Sun, and later Oracle, have maintained this document.<br /><br />Java provides two APIs that support reflection: the <a href="http://docs.oracle.com/javase/tutorial/javabeans/">Java Beans API</a> and the <a href="http://docs.oracle.com/javase/tutorial/reflect/index.html">Reflection API</a>. A Java Bean is a piece of code that specifically knows information about itself; beans are often used to build self-aware code for applications such as IDEs or GUI builders. The Reflection API consists of a series of classes that enable a Java program to answer questions about its internal structure.<br /><br />Using the reflection API, a Java program can discover what classes are available in a package, including the specific details of the methods and fields a given class supports. A program can also read the value of a field using reflection, or even invoke a method using reflection. Not only can a program examine the classes and other items it uses, it can also discover what specific classes are provided by the Java Virtual Machine (JVM) that runs the program.<br /><br />Naturally, certain sensitive method calls will be restricted by a security manager; consequently the security manager must be aware of calls to those methods made indirectly via reflection. In addition to a security manager, Java provides access control on the fields and methods of classes, as do many object-oriented languages. For example, a class field that is marked &ldquo;private&rdquo; is inaccessible to any code except for the class's own methods. To preserve this property, the reflection API permits indirect access to a private class field only from code that could have accessed the field directly. It is always possible to construct a class that fails to adequately protect its private fields. This could be done by creating a method that returns a Field object containing a reference to one of the class&rsquo;s private fields.&nbsp; However, doing so violates both rule <a href="https://www.securecoding.cert.org/confluence/display/java/SEC05-J.+Do+not+use+reflection+to+increase+accessibility+of+classes%2C+methods%2C+or+fields">SEC05-J</a> in CERT's rules and rule 6-5 of Oracle's secure coding guidelines.<br /><strong><br />Current Exploit</strong><br /><br />The current exploit takes advantage of vulnerabilities that exist in Java's APIs for reflection, class loading, and the security manager. It first creates handles to two classes:<br />sun.org.mozilla.javascript.internal.Context and sun.org.mozilla.javascript.internal.GeneratedClassLoader. Both classes are in the sun.* package,&nbsp; which indicates that they are part of the internal architecture and are not intended for use by external classes. They are not declared as &ldquo;private.&rdquo; Instead, the applet SecurityManager prevents access to these classes as part of its security policy.&nbsp; If the exploit code tried to access them directly, the applet would terminate with a SecurityException. So how did the exploit gain access to these classes?<br /><br />The answer is the MBeanInstantiator class. This class, which is also part of the Java distribution,&nbsp; provides a findClass() method that can be used to access the sun.* classes, even when running with a <a href="https://partners.immunityinc.com/idocs/Java MBeanInstantiator.findClass 0day Analysis.pdf">security manager that is intended to forbid access to such classes</a>. The exploit code must merely create a MBeanInstantiator object;&nbsp;then it can obtain handles to any classes it wants.<br /><br />The second goal of the exploit is to construct code that runs outside of the security sandbox. To accomplish this goal, it needs a class loader. These objects construct Java code from various sources, such as a local Java .class file, a web stream, or even a string of bytes. This is what the sun.org.mozilla.javascript.internal.GeneratedClassLoader is for. However, the Security Manager would terminate a process that attempts to construct a new class loader. Consequently, the exploit code cannot construct these objects directly. It could use reflection, but the reflection classes also contain security manager checks to prevent the exploit code from using them to do what it can't do itself.<br /><br />Unfortunately, the java.lang.invoke.MethodHandles.Lookup class fails to perform adequate security manager checks. This class is part of the Invoke API, which is a new addition to the Reflection API in Java 7, and has yet to appear in Oracle's secure coding standards. It can be used to invoke constructors and methods.&nbsp; It does perform a security manager check before proceeding, but, because of a bug involving the new java.lang.invoke.* API, the exploit code passes the security manager check. This bug involves the reflection API trying to determine which method called it.<br /><br />Because the reflection methods delegate work to each other, they typically ignore each other when trying to determine what method invoked a reflection method. However, they fail to ignore the new methods in java.lang.invoke.*. Instead they incorrectly identify one of the methods in java.lang.invoke.* as the caller, and so they decide the caller method is trusted. As a result, the exploit is able to load and execute untrusted code that is included as a byte string.<br /><br />The untrusted code simply sets the System.securityManager to null, disabling security, and letting the exploit proceed to do anything it desires.<br /><strong><br />August Exploit</strong><br /><br />The August exploit is similar but more direct. It uses several reflection classes in the Beans API to build a single statement outside of the security sandbox and execute it. This statement also sets System.securityManager to null, giving the exploit code full permissions. The security manager should prevent the exploit code from creating new code with no security restrictions but it doesn&rsquo;t.&nbsp; The reason again is that a private-to-Oracle class incorrectly grants full privileges to the statement. In this case, the sun.awt.SunToolkit class returns a Field object pointing to the private Statement.acc field.&nbsp; The Field object can then be set, permitting the Statement to execute with no security check. In this case, the sun.awt.SunToolkit.getField() class violates CERT rule SEC05-J, as it uses reflection to give untrusted code access to a field that the untrusted code could not access directly.<br /><br />Both exploits access code in the sun.* package, which should normally be inaccessible to applets. The current exploit accomplished this using the MBeanInstantiator class. The August exploit used a different approach. The August exploit used Class.forName() directly rather than using MBeanInstantiator. (In fact, the MBeanInstantiator class also relies on the Class.forName() method to access classes.) The August exploit worked because of a second vulnerability permitting the exploit code to access sensitive classes via Class.forName(). While calling Class.forName() directly would have been caught by the security manager, the exploit uses reflection instead, creating an Expression object that runs Class.forName() when invoked. This is because the java.beans.Statement class (which is invoked by the Expression class) used a special case to allow Class.forName() to be executed, even if the security manager disallowed it.<br /><br /><strong>Conclusions</strong><br /><br />The exploits examined in this blog post each relied on two vulnerabilities. In each case, the first vulnerability served to grant the exploits access to sensitive private classes that are used internally by Java. Both of these initial vulnerabilities appeared in the Beans API, which provides similar features to the Reflection API, and bypassed normal security manager checks.&nbsp; Once the exploit code had access to the sensitive classes, it was then able to use them to execute a statement that disabled the security manager. The current exploit code used reflection to hide this from the security manager, while the August exploit code used the Beans API, which lacked adequate security manager checks.<br /><br />While many previous Java vulnerabilities were actually vulnerabilities in the C code of a particular Java implementation, these exploits ran with pure Java&mdash;no underlying C/C++ vulnerability was involved. The current proof-of-concept exploit relies on classes that are specific to Oracle's JVM and are unavailable on other implementations, such as OpenJDK. However reports, while unclear, indicate that <a href="https://bugzilla.redhat.com/show_bug.cgi?id=894172">OpenJDK contains similar vulnerabilities</a>. While OpenJDK lacks the same sun.* classes found in the Oracle JDK, it does contain private class loaders, so this exploit could plausibly work on OpenJDK with minor modifications.<br /><br />A comparison of Java vulnerabilities with vulnerabilities in C/C++ would be a daunting task. Like many organizations, CERT maintains a <a href="http://www.kb.cert.org/vuls/id/636312">database of vulnerabilities</a>. However, although simple statistical searches on the data reveal raw numbers of database entries, these numbers are insufficient for assessing the collective severities of vulnerabilities in one language compared to another. Furthermore, as noted above, many Java vulnerabilities are really C vulnerabilities that occur in an implementation of Java. We can note that many C vulnerabilities, such as buffer overflows, tend to result from writing outside the bounds of an object. This is not possible in a secure implementation of Java; its design mandates memory safety. We can also note that injection attacks, such as SQL injection, cross-site scripting (XSS), and command injection, occur in all languages that permit string manipulation. <br /><br />Finally, the vulnerabilities analyzed in this blog post exploit Java&rsquo;s security mechanism, which was designed to allow safe execution of untrusted code in a secured environment. The consequence is that the current implementation of the security mechanism is insufficient; the remainder of the language is unaffected. That is, this vulnerability does not prevent Java from running desktop applications, or in fact, any programs that don&rsquo;t use Java&rsquo;s SecurityManager. Java is unusual in providing this feature; most language implementations lack any mechanism for safe execution of untrusted code. These exploits serve as a cautionary warning to other language implementations that wish to permit the execution of untrusted code inside some form of sandbox.</p>]]>
    </content>
</entry>

<entry>
    <title>Java in Web Browser: Disable Now!</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2013/01/java_in_web_browser_disable_no.html" />
    <id>tag:www.cert.org,2013:/blogs/certcc//1.131</id>

    <published>2013-01-10T22:20:02Z</published>
    <updated>2013-01-10T22:18:51Z</updated>

    <summary>Hi, it&apos;s Will and Art here. We&apos;ve been telling people to disable Java for years. In fact, the first version of the Securing Your Web Browser document from 2006 provided clear recommendations for disabling Java in web browsers. However, after...</summary>
    <author>
        <name>Art Manion</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, it's Will and Art here. We've been telling people to disable Java for years. In fact, the first version of the Securing Your Web Browser document from 2006 provided clear recommendations for disabling Java in web browsers. However, after investigating the <a href="http://www.kb.cert.org/vuls/id/636312">Java 7 vulnerability from August</a>, I realized that completely disabling Java in web browsers is not as simple as it should be.</p><p>Luckily, Oracle has since added a new option in the Java control panel applet to <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html#disable">disable Java in the browser</a>. If you haven't already done so, now is the time to disable Java in the browser.</p>]]>
        <![CDATA[<p><strike>Surprise</strike>, another serious Java vulnerability (<a href="http://www.kb.cert.org/vuls/id/625617">VU#625617</a>, <span><a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0422">CVE-2013-0422</a></span>), similar in some ways to the last serious Java vulnerability (<a href="http://www.kb.cert.org/vuls/id/636312">VU#636312</a>, <span><a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4681">CVE-2012-4681</a>), has been discovered. Self-quoting from <a href="http://www.cert.org/blogs/certcc/2012/09/java_7_attack_vectors_oh_my.html">last time</a>:<br /></span></p><blockquote><p>We strongly recommend disabling Java support in web browsers&mdash;and also applying any and all Java security updates.</p><p>Is installing the [7u7] update necessary? Yes. Is it sufficient? No.</p></blockquote><p>Not much has changed. Like CVE-2012-4681, this new vulnerability doesn't involve memory corruption, so EMET and other runtime mitigation techniques won't help you. Java is cross platform, accessible via web browsers, and has architectural soft spots related to reflection, SecurityManager, and the Java sandbox. The Next Generation Java Plug-in (used by default) runs out-of-process, so web browser sandboxing and <a href="http://windows.microsoft.com/en-US/windows-vista/What-does-Internet-Explorer-protected-mode-do">Internet Explorer Protected Mode</a> are out of the way. These are some of the reasons that make Java an attractive target for attack. And that's why (self-quoting again):</p><blockquote><p>We strongly recommend disabling Java support in web browsers.  And leave it off.</p></blockquote><p>As mentioned earlier, Java 7u10 now provides a one-click option to <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/client-security.html#disable">disable Java in web browsers</a> along with some other <a href="https://blogs.oracle.com/java/entry/java_se_7u10_support_for">security enhancements</a>. This is a huge improvement over the previous situation, especially for <a href="http://www.kb.cert.org/vuls/id/636312#disable_java_in_IE">Internet Explorer</a>.</p><p>We have confirmed that <a href="http://www.kb.cert.org/vuls/id/625617">VU#625617</a> can be used to reliably execute code on Windows, OS X, and Linux platforms. And the exploit code for the vulnerability is publicly available and already incorporated into exploit kits. This should be enough motivation for you to turn Java off. How can you determine whether you need Java in your browser? Turn it off and see how many web sites break. If the web works fine, then leave it off. You may be pleasantly surprised (and safer as a result).</p>]]>
    </content>
</entry>

<entry>
    <title>Forking and Joining Python Coroutines to Collect Coverage Data</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2012/12/forking_and_joining_python_cor.html" />
    <id>tag:www.cert.org,2012:/blogs/certcc//1.125</id>

    <published>2012-12-05T22:39:05Z</published>
    <updated>2012-12-06T12:44:11Z</updated>

    <summary>In this post I&apos;ll explain how to expand on David Beazley&apos;s cobroadcast pattern by adding a join capability that can bring multiple forked coroutine paths back together. I&apos;ll apply this technique to create a modular Python script that uses gcov,...</summary>
    <author>
        <name>Jonathan Foote</name>
        
    </author>
    
        <category term="Analysis" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Research" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<div>In this post I'll explain how to expand on David Beazley's <a href="http://dabeaz.com/coroutines/cobroadcast.py">cobroadcast</a> pattern by adding a <em>join</em> capability that can bring multiple <em>forked</em> coroutine paths back together. I'll apply this technique to create a modular Python script that uses gcov, readelf, and other common unix command line utilities to gather code coverage information for an application that is being tested. Along the way I'll use <a href="http://www.imagemagick.org">ImageMagick</a> under Ubuntu 12.04 as a running example.</div>]]>
        <![CDATA[<div><h3>Coroutines</h3></div> <div>In the Python programming language, coroutines are an extension of  the generator language construct that enables programmers to write  clean, efficient code for data processing, concurrency, and other common  tasks. You can read more about coroutines in <a href="http://www.python.org/dev/peps/pep-0342/">PEP 342</a> and <a href="http://www.dabeaz.com/">David Beazley's</a> <a href="http://dabeaz.com/coroutines/">Curious Course on Coroutines</a>. Once you become comfortable with coroutine conventions they can be quite useful.</div> <div><h3>Measuring Code Coverage with gcov</h3></div> <div>There are several useful GUI&nbsp;tools built on top of the GNU coverage testing tool (gcov), such as <a href="http://ggcov.sourceforge.net/">ggcov</a> and <a href="http://ltp.sourceforge.net/coverage/lcov.php">lcov</a>. In this blog post I'll write a new non-GUI gcov wrapper script to&nbsp;motivate the application of coroutines and the new Broadcaster pattern. I'll start by&nbsp;briefly discussing how gcov works.</div> <div>&nbsp;</div> <div>To use gcov, first you compile the target application with flags that cause application executions to produce coverage information. See the gcov documentation for more info on compilation flags.</div> <div>&nbsp;</div> <div><code>$ apt-get source imagemagick</code></div> <div><code>$ cd imagemagick-6.6.9.7/</code></div> <div><code>$ ./configure CFLAGS=&quot;-fprofile-arcs -ftest-coverage -g -O0&quot; \</code></div> <div><code>CXXFLAGS=&quot;-g -O0 -pthread&quot; &amp;&amp; make</code></div> <div>&nbsp;</div> <div>Then, you run the application to generate coverage information:</div> <div>&nbsp;</div> <div><code>$ wget http://www.kb.cert.org/registration/cert_logo.gif</code></div> <div><code>$ ./utilities/convert cert_logo.gif cert_logo.png</code></div> <div><code>lt-convert: UnableToOpenConfigureFile `delegates.xml' @ warning/configure.c/GetConfigureOptions/589</code>.</div> <div>&nbsp;</div> <div>Note that in this example we run only one invocation of a program. A more realistic application of this technique would include running a test suite against the program, running multiple randomized tests against the program (as with <a href="http://www.cert.org/vuls/discovery/bff.html">the CERT Basic Fuzzing Framework [BFF]</a>), or applying some other more thorough testing scheme.</div> <div>&nbsp;</div> <div>Regardless, at this point every object file that was used during execution now has a corresponding .gcda file that contains coverage information about the execution. gcov takes a gcda file and a source file as input and describes the coverage for that source file with respect to the gcda file. For example, first we find a gcda file:</div> <div>&nbsp;</div> <div><code>$ find . -name &quot;*.gcda&quot; | head -n 2</code></div> <div><code>./utilities/convert.gcda</code></div> <div><code>./wand/.libs/wand_libMagickWand_la-display.gcda</code></div> <div>&nbsp;</div> <div>Then we pick one, along with the correspond source file (explained below), and get coverage information for the source file with gcov:</div> <div>&nbsp;</div> <div><code>$ gcov -o ./wand/.libs/wand_libMagickWand_la-display.o ./wand/display.c &nbsp; &nbsp; &nbsp; &nbsp;</code></div> <div><code>File 'wand/display.c'</code></div> <div><code>Lines executed:0.00% of 1098</code></div> <div><code>wand/display.c:creating 'display.c.gcov'</code></div> <div><code>&nbsp;</code></div> <div><code>File './magick/string-private.h'</code></div> <div><code>Lines executed:0.00% of 2</code></div> <div><code>./magick/string-private.h:creating 'string-private.h.gcov'</code></div> <div>&nbsp;</div> <div>Normally a developer will know which source files correspond to which object files, but for someone unfamiliar with the code it can be tricky. For example, there is no &quot;wand_libMagickWand_la-display&quot; .c file in the ImageMagick source tree:</div> <div>&nbsp;</div> <div><code>$ find . -name &quot;wand_libMagickWand_la-display*.c&quot;</code></div> <div><code>$</code></div> <div>&nbsp;</div> <div>One way quick-and-dirty way to determine which source files a gcda file corresponds to is to examine the debug information of the object file that corresponds to a gcda file via readelf.</div> <div>&nbsp;</div> <div><code>$ readelf --debug-dump ./wand/.libs/wand_libMagickWand_la-display.o </code><code>| \</code></div> <div><code>grep -A50 &quot;The File Name Table&quot;</code></div> <div><code>&nbsp;The File Name Table:</code></div> <div><code>&nbsp; Entry<span class="Apple-tab-span" style="white-space:pre">	</span>Dir<span class="Apple-tab-span" style="white-space:pre">	</span>Time<span class="Apple-tab-span" style="white-space:pre">	</span>Size<span class="Apple-tab-span" style="white-space:pre">	</span>Name</code></div> <div><code>&nbsp; 1<span class="Apple-tab-span" style="white-space:pre">	</span>1<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>string-private.h</code></div> <div><code>&nbsp; 2<span class="Apple-tab-span" style="white-space:pre">	</span>2<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>display.c</code></div> <div><code>&nbsp; 3<span class="Apple-tab-span" style="white-space:pre">	</span>3<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>stddef.h</code></div> <div><code>&nbsp; 4<span class="Apple-tab-span" style="white-space:pre">	</span>4<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>0<span class="Apple-tab-span" style="white-space:pre">	</span>types.h</code></div> <div><code>...</code></div> <div>&nbsp;</div> <div>Next, we can find a source file by looking for a filename match in the parent directory of the .o file:</div> <div>&nbsp;</div> <div><code>$ find . -name &quot;display.c&quot;</code></div> <div><code>./utilities/display.c</code></div> <div><code>./wand/display.c &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;# &lt;--- in the nearest parent directory</code></div> <div><code>./magick/display.c</code></div> <div>&nbsp;</div> <div>Now we are ready to run gcov on a source file, as described above:</div> <div>&nbsp;</div> <div><code>$ gcov -o ./wand/.libs/wand_libMagickWand_la-display.o ./wand/display.c</code></div> <div><code>File 'wand/display.c'</code></div> <div><code>Lines executed:0.00% of 1098</code></div> <div><code>wand/display.c:creating 'display.c.gcov'</code></div> <div><code>&nbsp;</code></div> <div><code>File './magick/string-private.h'</code></div> <div><code>Lines executed:0.00% of 2</code></div> <div><code>./magick/string-private.h:creating 'string-private.h.gcov'</code></div> <div><h3>Using Python to Automate Collecting Code Coverage Information</h3></div> <div>We can automate the process above for all files in the ImageMagick directory using Python. Here we write a crude first attempt that uses nested loops:</div> <div>&nbsp;</div> <div><code>$ cat &gt; nestcov.py</code></div> <pre style="color:#000000;background:#ffffff;"><span style="color:#800000; font-weight:bold; ">import</span> re<span style="color:#808030; ">,</span> os
<span style="color:#800000; font-weight:bold; ">from</span> collections <span style="color:#800000; font-weight:bold; ">import</span> namedtuple
FileCoverage <span style="color:#808030; ">=</span> namedtuple<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;FileCoverage&quot;</span><span style="color:#808030; ">,</span> <span style="color:#808030; ">[</span><span style="color:#0000e6; ">&quot;filename&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;percentage&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;lines&quot;</span><span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>

<span style="color:#800000; font-weight:bold; ">def</span> call<span style="color:#808030; ">(</span>cmd<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#800000; font-weight:bold; ">import</span> subprocess<span style="color:#808030; ">,</span> shlex
  <span style="color:#800000; font-weight:bold; ">return</span> subprocess<span style="color:#808030; ">.</span>check_output<span style="color:#808030; ">(</span>shlex<span style="color:#808030; ">.</span>split<span style="color:#808030; ">(</span>cmd<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>

srcdir <span style="color:#808030; ">=</span> os<span style="color:#808030; ">.</span>getcwd<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span>
coverage <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
gcda_filenames <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;find %s -name \&quot;*.gcda\&quot;&quot;</span> <span style="color:#808030; ">%</span> srcdir<span style="color:#808030; ">)</span>
<span style="color:#800000; font-weight:bold; ">for</span> gcda_filename <span style="color:#800000; font-weight:bold; ">in</span> gcda_filenames<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  obj_filename <span style="color:#808030; ">=</span> gcda_filename<span style="color:#808030; ">.</span>replace<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;.gcda&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;.o&quot;</span><span style="color:#808030; ">)</span>
  instr <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;readelf --debug-dump %s&quot;</span> <span style="color:#808030; ">%</span> obj_filename<span style="color:#808030; ">)</span>

  <span style="color:#696969; "># get filenames from readelf output</span>
  outstr <span style="color:#808030; ">=</span> instr<span style="color:#808030; ">[</span>instr<span style="color:#808030; ">.</span>find<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;The File Name Table&quot;</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span><span style="color:#808030; ">]</span>
  outstr <span style="color:#808030; ">=</span> outstr<span style="color:#808030; ">[</span><span style="color:#808030; ">:</span>outstr<span style="color:#808030; ">.</span>find<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;\n\n&quot;</span><span style="color:#808030; ">)</span><span style="color:#808030; ">]</span>
  outlines <span style="color:#808030; ">=</span> outstr<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">2</span><span style="color:#808030; ">:</span><span style="color:#808030; ">]</span>
  c_files <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
  <span style="color:#800000; font-weight:bold; ">for</span> line <span style="color:#800000; font-weight:bold; ">in</span> outlines<span style="color:#808030; ">:</span>
    filename <span style="color:#808030; ">=</span> line<span style="color:#808030; ">.</span>split<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">4</span><span style="color:#808030; ">]</span>
    <span style="color:#800000; font-weight:bold; ">if</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;.*\.c$|.*\.c..$&quot;</span><span style="color:#808030; ">,</span> filename<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
      src_filename <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;find %s -name %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">,</span> filename<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">0</span><span style="color:#808030; ">]</span>
      gcov_out <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;gcov -no %s %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span>gcda_filename<span style="color:#808030; ">,</span> src_filename<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
      filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
      <span style="color:#800000; font-weight:bold; ">for</span> gline <span style="color:#800000; font-weight:bold; ">in</span> gcov_out<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
        <span style="color:#800000; font-weight:bold; ">if</span> filename<span style="color:#808030; ">:</span>
          m <span style="color:#808030; ">=</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;^Lines executed:(\d+\.\d\d)% of (\d+)$&quot;</span><span style="color:#808030; ">,</span> gline<span style="color:#808030; ">)</span>
          <span style="color:#800000; font-weight:bold; ">if</span> <span style="color:#800000; font-weight:bold; ">not</span> m<span style="color:#808030; ">:</span>
            <span style="color:#800000; font-weight:bold; ">raise</span> <span style="color:#e34adc; ">RuntimeError</span><span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;Failure parsing gcov output; 'Lines' doesn't follow 'Files'&quot;</span><span style="color:#808030; ">)</span>
          percent<span style="color:#808030; ">,</span> lines <span style="color:#808030; ">=</span> m<span style="color:#808030; ">.</span>groups<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span>
          coverage<span style="color:#808030; ">.</span>append<span style="color:#808030; ">(</span>FileCoverage<span style="color:#808030; ">(</span>filename<span style="color:#808030; ">,</span> <span style="color:#e34adc; ">float</span><span style="color:#808030; ">(</span>percent<span style="color:#808030; ">)</span><span style="color:#808030; ">,</span> <span style="color:#e34adc; ">int</span><span style="color:#808030; ">(</span>lines<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
          filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
          <span style="color:#800000; font-weight:bold; ">continue</span>
        m <span style="color:#808030; ">=</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;^File '(.*)'$&quot;</span><span style="color:#808030; ">,</span> gline<span style="color:#808030; ">)</span>
        <span style="color:#800000; font-weight:bold; ">if</span> <span style="color:#800000; font-weight:bold; ">not</span> m<span style="color:#808030; ">:</span>
          filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
          <span style="color:#800000; font-weight:bold; ">continue</span>
        filename <span style="color:#808030; ">=</span> m<span style="color:#808030; ">.</span>groups<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">0</span><span style="color:#808030; ">]</span>
total_lines <span style="color:#808030; ">=</span> sum<span style="color:#808030; ">(</span><span style="color:#808030; ">[</span>fc<span style="color:#808030; ">.</span>lines <span style="color:#800000; font-weight:bold; ">for</span> fc <span style="color:#800000; font-weight:bold; ">in</span> coverage<span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>
total_covered <span style="color:#808030; ">=</span> sum<span style="color:#808030; ">(</span><span style="color:#808030; ">[</span>fc<span style="color:#808030; ">.</span>percentage<span style="color:#808030; ">*</span>fc<span style="color:#808030; ">.</span>lines<span style="color:#808030; ">/</span><span style="color:#008c00; ">100</span> <span style="color:#800000; font-weight:bold; ">for</span> fc <span style="color:#800000; font-weight:bold; ">in</span> coverage<span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>
total_percentage <span style="color:#808030; ">=</span> total_covered <span style="color:#808030; ">/</span> total_lines
<span style="color:#800000; font-weight:bold; ">print</span> total_percentage
</pre> <div><code>&lt;CTRL-D&gt;</code></div> <div>&nbsp;</div> <div>We can then run the script and play with the results:</div> <div>&nbsp;</div> <div><code>$ &nbsp;python -i nestcov.py</code></div> <div><code>0.0552162336542</code></div> <div><code>&gt;&gt;&gt; for fc in coverage:</code></div> <div><code>... &nbsp; if fc.percentage &gt; 0:</code></div> <div><code>... &nbsp; &nbsp; print fc.filename, fc.percentage</code></div> <div><code>...&nbsp;</code></div> <div><code>utilities/convert.c 100.0</code></div> <div><code>wand/mogrify.c 2.35</code></div> <div><code>./magick/monitor-private.h 60.0</code></div> <div><code>./wand/mogrify-private.h 57.14</code></div> <div><code>wand/convert.c 2.31</code></div> <div><code>coders/xbm.c 5.49</code></div> <div><code><font face="monospace">...</font></code>&nbsp;</div> <div><h3>Cleaning Up the Script with Coroutines</h3></div> <div>The code above works, but it somewhat difficult to read and is not easily unit tested. We can use coroutines to modularize the code above without introducing any additional loop iterations into the algorithm. Roughly speaking, you can use coroutines like you would use <a href="http://www.kernel.org/doc/man-pages/online/pages/man7/pipe.7.html">pipes</a> in bash. We can implement something like the bash command below directly via coroutines:</div> <div>&nbsp;</div> <div><code>$ find . -name &quot;*.gcda&quot; | sed s/&quot;.gcda$&quot;/&quot;.o&quot;</code></div> <div>&nbsp;</div> <div>To accomplish this, we can first implement all of the &quot;functions&quot; we used in our algorithm as coroutines. First, we should get <a href="http://dabeaz.com/coroutines/coroutine.py">David Beazley's handy coroutine decorator</a>:</div> <div>&nbsp;</div> <div><code>$ wget http://dabeaz.com/coroutines/coroutine.py</code></div> <div>&nbsp;</div> <div>Then we can implement our functions:</div> <div>&nbsp;</div> <div><code>$ cat &gt; cocov.py</code></div> <pre style="color:#000000;background:#ffffff;"><span style="color:#800000; font-weight:bold; ">import</span> re<span style="color:#808030; ">,</span> os
<span style="color:#800000; font-weight:bold; ">from</span> collections <span style="color:#800000; font-weight:bold; ">import</span> namedtuple
<span style="color:#800000; font-weight:bold; ">from</span> coroutine <span style="color:#800000; font-weight:bold; ">import</span> coroutine

FileCoverage <span style="color:#808030; ">=</span> namedtuple<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;FileCoverage&quot;</span><span style="color:#808030; ">,</span> <span style="color:#808030; ">[</span><span style="color:#0000e6; ">&quot;filename&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;percentage&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;lines&quot;</span><span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>

<span style="color:#800000; font-weight:bold; ">def</span> call<span style="color:#808030; ">(</span>cmd<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#800000; font-weight:bold; ">import</span> subprocess<span style="color:#808030; ">,</span> shlex
  <span style="color:#800000; font-weight:bold; ">return</span> subprocess<span style="color:#808030; ">.</span>check_output<span style="color:#808030; ">(</span>shlex<span style="color:#808030; ">.</span>split<span style="color:#808030; ">(</span>cmd<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>

<span style="color:#800000; font-weight:bold; ">def</span> gcdas<span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">,</span> target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Finds all gcda files in srcdir and sends them to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  gcda_filenames <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;find %s -name \&quot;*.gcda\&quot;&quot;</span> <span style="color:#808030; ">%</span> srcdir<span style="color:#808030; ">)</span>
  <span style="color:#800000; font-weight:bold; ">for</span> gcda_filename <span style="color:#800000; font-weight:bold; ">in</span> gcda_filenames<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
    target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>gcda_filename<span style="color:#808030; ">)</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> objfile<span style="color:#808030; ">(</span>target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Converts the received gcda filemame to its corresponding object filename (see</span>
<span style="color:#696969; ">&nbsp;&nbsp;gcov docs) and sends it to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>re<span style="color:#808030; ">.</span>sub<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;\.gcda$&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;.o&quot;</span><span style="color:#808030; ">,</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> readelf<span style="color:#808030; ">(</span>target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Sends the debug file table section of the received elf file to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    instr <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;readelf --debug-dump %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>

    outstr <span style="color:#808030; ">=</span> instr<span style="color:#808030; ">[</span>instr<span style="color:#808030; ">.</span>find<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;The File Name Table&quot;</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span><span style="color:#808030; ">]</span>
    outstr <span style="color:#808030; ">=</span> outstr<span style="color:#808030; ">[</span><span style="color:#808030; ">:</span>outstr<span style="color:#808030; ">.</span>find<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;\n\n&quot;</span><span style="color:#808030; ">)</span><span style="color:#808030; ">]</span>
    target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>outstr<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">2</span><span style="color:#808030; ">:</span><span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> filenames<span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">,</span> target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Gets filenames from received filetable and searches up the path of</span>
<span style="color:#696969; ">&nbsp;&nbsp;the received gcda_filename for a path for each respective filename.</span>
<span style="color:#696969; ">&nbsp;&nbsp;When a path is found, it is sent to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;More generally, this coroutine takes in the file table section from </span>
<span style="color:#696969; ">&nbsp;&nbsp;the readelf command and produces a path for the file on the filesystem</span>
<span style="color:#696969; ">&nbsp;&nbsp;that most likely matches the file, respectively.</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    c_files <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
    gcda_filename<span style="color:#808030; ">,</span> filetable <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
    <span style="color:#800000; font-weight:bold; ">for</span> line <span style="color:#800000; font-weight:bold; ">in</span> filetable<span style="color:#808030; ">:</span>
      filename <span style="color:#808030; ">=</span> line<span style="color:#808030; ">.</span>split<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">4</span><span style="color:#808030; ">]</span>
      <span style="color:#800000; font-weight:bold; ">if</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;.*\.c$|.*\.c..$&quot;</span><span style="color:#808030; ">,</span> filename<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
        searchdir <span style="color:#808030; ">=</span> gcda_filename
        <span style="color:#800000; font-weight:bold; ">while</span> searchdir <span style="color:#808030; ">!</span><span style="color:#808030; ">=</span> srcdir<span style="color:#808030; ">:</span>
          searchdir <span style="color:#808030; ">=</span> os<span style="color:#808030; ">.</span>path<span style="color:#808030; ">.</span>dirname<span style="color:#808030; ">(</span>searchdir<span style="color:#808030; ">)</span>
          found <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;find %s -name %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span>searchdir<span style="color:#808030; ">,</span> filename<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
          <span style="color:#800000; font-weight:bold; ">if</span> found<span style="color:#808030; ">:</span>
            target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span><span style="color:#808030; ">(</span>gcda_filename<span style="color:#808030; ">,</span> found<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">0</span><span style="color:#808030; ">]</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
            <span style="color:#800000; font-weight:bold; ">break</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> gcov<span style="color:#808030; ">(</span>target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Reads the gcov output for the received gcda_filename and src_filename. </span>
<span style="color:#696969; ">&nbsp;&nbsp;Produces a FileCoverage object for each entry in the gcov output and sends</span>
<span style="color:#696969; ">&nbsp;&nbsp;it to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    gcda_filename<span style="color:#808030; ">,</span> src_filename <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
    gcov_out <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;gcov -no %s %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span>gcda_filename<span style="color:#808030; ">,</span> src_filename<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
    filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
    <span style="color:#800000; font-weight:bold; ">for</span> gline <span style="color:#800000; font-weight:bold; ">in</span> gcov_out<span style="color:#808030; ">.</span>splitlines<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
      <span style="color:#800000; font-weight:bold; ">if</span> filename<span style="color:#808030; ">:</span>
        m <span style="color:#808030; ">=</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;^Lines executed:(\d+\.\d\d)% of (\d+)$&quot;</span><span style="color:#808030; ">,</span> gline<span style="color:#808030; ">)</span>
        <span style="color:#800000; font-weight:bold; ">if</span> <span style="color:#800000; font-weight:bold; ">not</span> m<span style="color:#808030; ">:</span>
          <span style="color:#800000; font-weight:bold; ">raise</span> <span style="color:#e34adc; ">RuntimeError</span><span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;Failure parsing gcov output; 'Lines' &quot;</span>
            <span style="color:#0000e6; ">&quot;doesn't follow 'Files'&quot;</span><span style="color:#808030; ">)</span>
        percent<span style="color:#808030; ">,</span> lines <span style="color:#808030; ">=</span> m<span style="color:#808030; ">.</span>groups<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span>
        target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>FileCoverage<span style="color:#808030; ">(</span>filename<span style="color:#808030; ">,</span> <span style="color:#e34adc; ">float</span><span style="color:#808030; ">(</span>percent<span style="color:#808030; ">)</span><span style="color:#808030; ">,</span> <span style="color:#e34adc; ">int</span><span style="color:#808030; ">(</span>lines<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
        filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
        <span style="color:#800000; font-weight:bold; ">continue</span>
      m <span style="color:#808030; ">=</span> re<span style="color:#808030; ">.</span>match<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;^File '(.*)'$&quot;</span><span style="color:#808030; ">,</span> gline<span style="color:#808030; ">)</span>
      <span style="color:#800000; font-weight:bold; ">if</span> <span style="color:#800000; font-weight:bold; ">not</span> m<span style="color:#808030; ">:</span>
        filename <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">None</span>
        <span style="color:#800000; font-weight:bold; ">continue</span>
      filename <span style="color:#808030; ">=</span> m<span style="color:#808030; ">.</span>groups<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">[</span><span style="color:#008c00; ">0</span><span style="color:#808030; ">]</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> printer<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    <span style="color:#800000; font-weight:bold; ">print</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>

@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> merger<span style="color:#808030; ">(</span>coverage<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  seen <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
  <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
    file_coverage <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
    <span style="color:#800000; font-weight:bold; ">if</span> file_coverage<span style="color:#808030; ">.</span>filename <span style="color:#800000; font-weight:bold; ">in</span> seen<span style="color:#808030; ">:</span>
      <span style="color:#696969; "># coverage defined in multiple files</span>
      <span style="color:#800000; font-weight:bold; ">continue</span>
    seen<span style="color:#808030; ">.</span>append<span style="color:#808030; ">(</span>file_coverage<span style="color:#808030; ">.</span>filename<span style="color:#808030; ">)</span>
    coverage<span style="color:#808030; ">.</span>append<span style="color:#808030; ">(</span>file_coverage<span style="color:#808030; ">)</span>
</pre> <div><code>&lt;CTRL-D&gt;</code></div> <div>&nbsp;</div> <div>We can then implement the bash command from the beginning of this section in Python, like so:</div> <div>&nbsp;</div> <div><code>$ python -i cocov.py</code></div> <div><code>&gt;&gt; gcdas(os.getcwd(), objfile(printer()))</code></div> <div><code>/home/user0/blog/imagemagick-6.6.9.7/utilities/convert.o</code></div> <div><code>/home/user0/blog/imagemagick-6.6.9.7/wand/.libs/wand_libMagickWand_la-display.o</code></div> <div><code>/home/user0/blog/imagemagick-6.6.9.7/wand/.libs/wand_libMagickWand_la-magick-wand.o</code></div> <div><code>...</code></div> <div>&nbsp;</div> <div><h3>Forking and Joining Pipelines</h3></div> <div>Now we have all of the basic coroutines that we need to implement our script, however, there &nbsp;is one issue with the algorithm above that isn't handled well by <em>pipes</em>. In the nested version of the algorithm, the outermost loop iterates over all of the gcda filenames in the current directory. The current filename, <code>gcda_filename</code>, is used immediately inside the loop to determine the object filename for the gcda file:&nbsp;</div> <pre style="color:#000000;background:#ffffff;">
obj_filename <span style="color:#808030; ">=</span> gcda_filename<span style="color:#808030; ">.</span>replace<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;.gcda&quot;</span><span style="color:#808030; ">,</span> <span style="color:#0000e6; ">&quot;.o&quot;</span><span style="color:#808030; ">)</span>
</pre> <div>And <code>gcda_filename</code> ia nested loop to get the gcov output</div> <pre style="color:#000000;background:#ffffff;">
gcov_out <span style="color:#808030; ">=</span> call<span style="color:#808030; ">(</span><span style="color:#0000e6; ">&quot;gcov -no %s %s&quot;</span> <span style="color:#808030; ">%</span> <span style="color:#808030; ">(</span>gcda_filename<span style="color:#808030; ">,</span> src_filename<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
</pre> <div>If we represented the algorithm as an activity diagram, it might look like this:</div> <div>&nbsp;</div> <div><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img width="159" height="529" alt="cov_ad2.png" src="/blogs/certcc/2012/12/04/cov_ad2.png" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /></span></div> <div>&nbsp;</div> <div>Unfortunately, using the <em>pipe</em> pattern from bash does not allow information to <em>bypass</em> a function and be <em>merged</em> into the input to another downstream function. David Beazley has implemented a&nbsp;<a href="http://dabeaz.com/coroutines/cobroadcast.py">cobroadcast</a>&nbsp;pattern that accomplishes the <em>fanning out</em> of input from coroutines:</div> <pre style="color:#000000;background:#ffffff;"><span style="color:#696969; "># Broadcast a stream onto multiple targets</span>
@coroutine
<span style="color:#800000; font-weight:bold; ">def</span> broadcast<span style="color:#808030; ">(</span>targets<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
    <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
        item <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
        <span style="color:#800000; font-weight:bold; ">for</span> target <span style="color:#800000; font-weight:bold; ">in</span> targets<span style="color:#808030; ">:</span>
            target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>item<span style="color:#808030; ">)</span>
</pre> <div>&nbsp;</div> <div>This pattern is useful in that it lets one <em>fan out</em> a coroutine's output into several <em>pipes</em>.</div> <div>&nbsp;</div> <div><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img width="425" height="181" alt="broadcast_ad2.png" src="/blogs/certcc/2012/12/04/broadcast_ad2.png" class="mt-image-center" style="text-align: center; display: block; margin: 0 auto 20px;" /></span></div> <div>&nbsp;</div> <div>However, it does not allow for merging information back into the same pipeline as we require for our algorithm above. I have expanded David's code to support this functionality. We can tack it onto his coroutine implementation like so:</div> <div>&nbsp;</div> <div><code>$ cat &gt;&gt; coroutine.py</code></div> <pre style="color:#000000;background:#ffffff;"><span style="color:#800000; font-weight:bold; ">class</span> Broadcaster<span style="color:#808030; ">(</span>object<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;Allows users to broadcast output of a coroutine to multiple callees and then</span>
<span style="color:#696969; ">&nbsp;&nbsp;serialize results further down the call stream.</span>
<span style="color:#696969; ">&nbsp;&nbsp;WARNING: This design assumes that coroutines have one (yield) and one send().</span>
<span style="color:#696969; ">&nbsp;&nbsp;'''</span>
  <span style="color:#800000; font-weight:bold; ">def</span> <span style="color:#e34adc; ">__init__</span><span style="color:#808030; ">(</span>self<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
    self<span style="color:#808030; ">.</span>serial <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
  @coroutine
  <span style="color:#800000; font-weight:bold; ">def</span> fork<span style="color:#808030; ">(</span>self<span style="color:#808030; ">,</span> children<span style="color:#808030; ">,</span> target<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
    <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;Copies output sent to this coroutine to all coroutines in children. </span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;Results subsequently sent to Broadcaster.join() will be serialized (as a </span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;list) and sent to target.</span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;'''</span>
    self<span style="color:#808030; ">.</span>nchildren <span style="color:#808030; ">=</span> <span style="color:#e34adc; ">len</span><span style="color:#808030; ">(</span>children<span style="color:#808030; ">)</span>
    self<span style="color:#808030; ">.</span>target <span style="color:#808030; ">=</span> target
    <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
      item <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
      <span style="color:#800000; font-weight:bold; ">for</span> c <span style="color:#800000; font-weight:bold; ">in</span> children<span style="color:#808030; ">:</span>
        c<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>item<span style="color:#808030; ">)</span>
  @coroutine
  <span style="color:#800000; font-weight:bold; ">def</span> join<span style="color:#808030; ">(</span>self<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
    <span style="color:#696969; ">'''</span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;Results sent to this coroutine are stored. When all of the children passed </span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;to Broacaster.fork have sent results, a list of the results is sent to </span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;the target passed to Broadcaster.fork. </span>
<span style="color:#696969; ">&nbsp;&nbsp;&nbsp;&nbsp;'''</span>
    <span style="color:#800000; font-weight:bold; ">while</span> <span style="color:#e34adc; ">True</span><span style="color:#808030; ">:</span>
      result <span style="color:#808030; ">=</span> <span style="color:#808030; ">(</span><span style="color:#800000; font-weight:bold; ">yield</span><span style="color:#808030; ">)</span>
      self<span style="color:#808030; ">.</span>serial<span style="color:#808030; ">.</span>append<span style="color:#808030; ">(</span>result<span style="color:#808030; ">)</span>
      <span style="color:#800000; font-weight:bold; ">if</span> <span style="color:#e34adc; ">len</span><span style="color:#808030; ">(</span>self<span style="color:#808030; ">.</span>serial<span style="color:#808030; ">)</span> <span style="color:#808030; ">=</span><span style="color:#808030; ">=</span> self<span style="color:#808030; ">.</span>nchildren<span style="color:#808030; ">:</span>
        self<span style="color:#808030; ">.</span>target<span style="color:#808030; ">.</span>send<span style="color:#808030; ">(</span>self<span style="color:#808030; ">.</span>serial<span style="color:#808030; ">)</span>
        self<span style="color:#808030; ">.</span>serial <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
</pre> <div><code>&lt;CTRL-D&gt;</code></div> <div>&nbsp;</div> <div>We can use an instance of this class to <em>fan out</em> input from the gcda(..) coroutine and the <em>merge</em> it back into the gcov(..) coroutine.&nbsp;Here is what the code for our coverage pipeline might look like:</div> <div>&nbsp;</div> <div><code>$ cat &gt;&gt; cocov.py</code></div> <pre style="color:#000000;background:#ffffff;"><span style="color: rgb(128, 0, 0); font-weight: bold;">from</span> coroutine <span style="color: rgb(128, 0, 0); font-weight: bold;">import</span> Broadcaster</pre> <pre style="color:#000000;background:#ffffff;"><span style="color:#800000; font-weight:bold; ">def</span> get_coverage<span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">)</span><span style="color:#808030; ">:</span>
  coverage <span style="color:#808030; ">=</span> <span style="color:#808030; ">[</span><span style="color:#808030; ">]</span>
  bcast <span style="color:#808030; ">=</span> Broadcaster<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span>
  gcdas<span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">,</span>
  bcast<span style="color:#808030; ">.</span>fork<span style="color:#808030; ">(</span>
    <span style="color:#808030; ">[</span>bcast<span style="color:#808030; ">.</span>join<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">,</span>
    objfile<span style="color:#808030; ">(</span>readelf<span style="color:#808030; ">(</span>bcast<span style="color:#808030; ">.</span>join<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">]</span><span style="color:#808030; ">,</span>
  filenames<span style="color:#808030; ">(</span>srcdir<span style="color:#808030; ">,</span> gcov<span style="color:#808030; ">(</span>merger<span style="color:#808030; ">(</span>coverage<span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
  <span style="color:#800000; font-weight:bold; ">return</span> coverage
</pre> <div><code>&lt;CTRL-D&gt;</code></div> <div>&nbsp;</div> <div>The bcast.fork(..) call <em>fans out</em> the data from gcdas(..) and the bcast.join() calls terminate each <em>pipe</em> and <em>merge</em> the result into filenames(..). Note that it is possible to use this pattern with many pipes of varying lengths!</div> <div>&nbsp;</div> <div>Finally, we can use this code to gather coverage information for all ImageMagick source files and play with the result. Note that the total percentage covered (printed below) is slightly different than the number printed by the nested-loop implementation. This is due to the updated merging logic that is included in the coroutine version.</div> <div>&nbsp;</div> <div><code>$ cat &gt;&gt; cocov.py</code></div> <pre style="color:#000000;background:#ffffff;">
coverage <span style="color:#808030; ">=</span> get_coverage<span style="color:#808030; ">(</span>os<span style="color:#808030; ">.</span>getcwd<span style="color:#808030; ">(</span><span style="color:#808030; ">)</span><span style="color:#808030; ">)</span>
total_lines <span style="color:#808030; ">=</span> sum<span style="color:#808030; ">(</span><span style="color:#808030; ">[</span>fc<span style="color:#808030; ">.</span>lines <span style="color:#800000; font-weight:bold; ">for</span> fc <span style="color:#800000; font-weight:bold; ">in</span> coverage<span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>
total_covered <span style="color:#808030; ">=</span> sum<span style="color:#808030; ">(</span><span style="color:#808030; ">[</span>fc<span style="color:#808030; ">.</span>percentage<span style="color:#808030; ">*</span>fc<span style="color:#808030; ">.</span>lines<span style="color:#808030; ">/</span><span style="color:#008c00; ">100</span> <span style="color:#800000; font-weight:bold; ">for</span> fc <span style="color:#800000; font-weight:bold; ">in</span> coverage<span style="color:#808030; ">]</span><span style="color:#808030; ">)</span>
total_percentage <span style="color:#808030; ">=</span> total_covered <span style="color:#808030; ">/</span> total_lines
<span style="color:#800000; font-weight:bold; ">print</span> total_percentage
</pre> <div><code>&lt;CTRL-D&gt;</code></div> <div>&nbsp;</div> <div><code>$python -i cocov.py</code></div> <div><code>0.0560876868276</code></div> <div><code>&gt;&gt;&gt; for fc in coverage:</code></div> <div><code>... &nbsp; if fc.percentage &gt; 0:</code></div> <div><code>... &nbsp; &nbsp; print fc.filename, fc.percentage</code></div> <div><code>...&nbsp;</code></div> <div><code>utilities/convert.c 100.0</code></div> <div><code>wand/mogrify.c 2.35</code></div> <div><code>./wand/mogrify-private.h 57.14</code></div> <div><code>wand/convert.c 2.31</code></div> <div><code>...</code></div> <div><h3>Conclusion</h3></div> <div>In this post, I've explained how to apply a new <em>Broadcaster</em> pattern extended from the <em>cobroadcast </em>pattern in <a href="http://dabeaz.com/coroutines/">David Beazley's Curious Course on Coroutines</a> to create a usable code coverage gathering script. Along the way I've also showed how applying coroutines can advance a monolithic, nested-loop algorithm implementation to a modular pipeline pipline that promotes maintainability and testability.&nbsp;Thanks for reading!</div>]]>
    </content>
</entry>

<entry>
    <title>A Look Inside CERT Fuzzing Tools</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2012/11/a_look_inside_certs_fuzzing_fr.html" />
    <id>tag:www.cert.org,2012:/blogs/certcc//1.124</id>

    <published>2012-11-05T16:30:00Z</published>
    <updated>2012-11-05T16:29:40Z</updated>

    <summary>Hi, this is Allen Householder of the CERT Vulnerability Analysis team. If you&apos;ve been following this blog for a while, you are probably familiar with our fuzzing tools: Dranzer, the CERT Basic Fuzzing Framework (BFF), and the CERT Failure Observation...</summary>
    <author>
        <name>Allen Householder</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi, this is Allen Householder of the <a href="http://www.cert.org/vuls/">CERT Vulnerability Analysis team</a>. If you've been following this blog for a while, you are probably familiar with our fuzzing tools: <a href="http://www.cert.org/vuls/discovery/dranzer.html">Dranzer</a>, the <a href="http://www.cert.org/vuls/discovery/bff.html">CERT Basic Fuzzing Framework (BFF)</a>, and the <a href="http://www.cert.org/vuls/discovery/foe.html">CERT Failure Observation Engine (FOE)</a>.&nbsp;While creating tools that can find and analyze vulnerabilities makes up a significant portion of our work in the <a href="http://www.cert.org/vuls/">CERT Vulnerability Analysis team</a>, our <a href="http://www.cert.org/vuls/discovery/">focus</a> is on developing and communicating the knowledge we've built into those systems.</p><p>To that end, we recently published a pair of reports that describe a few of the heuristics and algorithms implemented in the&nbsp;BFF and FOE fuzzing tools. We briefly&nbsp;mentioned these techniques&nbsp;in the <a href="http://www.cert.org/blogs/certcc/2012/10/updates_to_cert_fuzzing_tools.html">release announcements</a> for the tools, but did not describe how they work in detail. Abstracts and links to the reports can be found below.</p>]]>
        <![CDATA[<p><strong><a href="http://www.sei.cmu.edu/library/abstracts/reports/12tn019.cfm">Probability-Based Parameter Selection for Black-Box Fuzz Testing</a></strong><br />Dynamic, randomized-input functional testing, or black-box fuzz testing, is an effective technique for finding security vulnerabilities in software applications. Parameters for an invocation of black-box fuzz testing generally include known-good input to use as a basis for randomization (i.e., a seed file) and a specification of how much of the seed file to randomize (i.e., the range). This report describes an algorithm that applies basic statistical theory to the parameter selection problem and automates selection of seed files and ranges. This algorithm was implemented in an open-source, file-interface testing tool and was used to find and mitigate vulnerabilities in several software applications. This report generalizes the parameter selection problem, explains the algorithm, and analyzes empirical data collected from the implementation. Results of using the algorithm show a marked improvement in the efficiency of discovering unique application errors over basic parameter selection techniques.</p><p><strong><a href="http://www.sei.cmu.edu/library/abstracts/reports/12tn018.cfm">Well There&rsquo;s Your Problem: Isolating the Crash-Inducing Bits in a Fuzzed File</a></strong><br />Mutational input testing (fuzzing, and in particular dumb fuzzing) is an effective technique for discovering vulnerabilities in software. However, many of the bitwise changes in fuzzed input files are not relevant to the actual software crashes found. This report describes an algorithm that efficiently reverts bits from the fuzzed file to those found in the original seed file, keeping only the minimal bits required to recreate the crash under investigation. This technique reduces the complexity of analyzing a crashing test case by eliminating the changes to the seed file that are not essential to the crash being evaluated.</p><p>By the way, we're hiring. We've got a few different vulnerability analysis openings along with a variety of other technical security positions posted at <a href="http://www.cert.org/jobs/">www.cert.org/jobs/</a>. If improving how vulnerabilities are discovered, analyzed, and remediated is your thing, we'd like to talk to you.</p>]]>
    </content>
</entry>

<entry>
    <title>Updates to CERT Fuzzing Tools (BFF 2.6 &amp; FOE 2.0.1)</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2012/10/updates_to_cert_fuzzing_tools.html" />
    <id>tag:www.cert.org,2012:/blogs/certcc//1.120</id>

    <published>2012-10-25T19:43:00Z</published>
    <updated>2012-10-25T19:43:46Z</updated>

    <summary><![CDATA[Hi everybody. Allen Householder from the CERT Vulnerability Analysis team here, back with another installment of &quot;What's new in CERT's fuzzing frameworks?&quot;&nbsp; Today we're announcing the release of updates of both our fuzzing tools, the CERT Basic Fuzzing Framework (BFF)...]]></summary>
    <author>
        <name>Allen Householder</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>Hi everybody. Allen Householder from the <a href="http://www.cert.org/vuls/">CERT Vulnerability Analysis</a> team here, back with another installment of &quot;What's new in CERT's fuzzing frameworks?&quot;&nbsp; Today we're announcing the release of updates of both our fuzzing tools, the <a href="http://www.cert.org/vuls/discovery/bff.html">CERT Basic Fuzzing Framework (BFF)</a> version 2.6 and the <a href="http://www.cert.org/vuls/discovery/foe.html">CERT Failure Observation Engine (FOE)</a> version 2.0.1. The remainder of this post describes the changes in more detail.</p>]]>
        <![CDATA[<p>In the past, our two fuzzing frameworks had been based on related code but developed separately. Beginning with the release of <a href="http://www.cert.org/blogs/certcc/2012/04/cert_basic_fuzzing_framework_v.html">BFF 2.5</a> in April and <a href="http://www.cert.org/blogs/certcc/2012/07/cert_failure_observation_engin_1.html">FOE 2.0</a> in July, we began to converge these code bases back together. Today's release marks a milestone in that we have now synchronized development so that both tools are built on the same version of the underlying libraries. But all that has happened behind the scenes. What you probably care about are the new features and fixes, so let's have a look at them.</p>
<p><strong>BFF 2.6 Includes CERT Triage Tools</strong></p>
<p>Version 2.6 of the CERT&nbsp;Basic Fuzzing Framework incorporates the <a href="http://www.cert.org/vuls/discovery/triage.html">CERT&nbsp;Triage Tools</a> version 1.04. Jonathan Foote's earlier <a href="http://www.cert.org/blogs/certcc/2012/04/cert_triage_tools_10.html">post </a>explains how this GNU Debugger (GDB) extension classifies Linux application bugs by severity. With the addition of the CERT Triage Tools to BFF, we have added automatic exploitability classification to our Linux fuzzing platform. BFF's GDB&nbsp;output now classifies crashing test cases into one of four categories: Exploitable, Probably Exploitable, Probably Not Exploitable, and Unknown.</p>
<p><strong>BFF 2.6 Improves Virtual Machine Reboot Recovery</strong></p>
<p>BFF 2.6 also incorporates improvements to fuzzing campaign recovery following a virtual machine reboot. In the past, the rangefinder and seedfile data was not consistently retained, and this led to a BFF campaign to recover its machine-learned data following each reboot. That is no longer the case. Learned parameter selection data is cached and recovered following a reboot so the campaign can pick up where it left off. You can read more about the underlying machine learning algorithm in our recently published SEI technical note <a href="http://www.sei.cmu.edu/library/abstracts/reports/12tn019.cfm"><em>Probability-Based Parameter Selection for Black-Box Fuzz Testing</em></a>.</p>
<p><strong>BFF 2.6 and FOE 2.0.1 Support Configurable Timeouts for Minimization </strong></p>
<p>Because minimization is a heuristic-based solution, some minimization runs can take a long time to complete. Time spent minimizing is time spent not fuzzing, and we'd rather be fuzzing than squeezing out a few more bytes from a test case. Benefitting from the integrated code base mentioned above, BFF 2.6 and FOE 2.0.1 include a new configuration option that allows the system to monitor and terminate a minimization if a timeout is exceeded. The default timeout is one hour, which should be long enough to minimize all but the most stubborn cases.</p>
<p><strong>FOE 2.0.1 Improves drillresults.py</strong></p>
<p>FOE 2.0 introduced the <code><tt>drillresults.py</tt></code> script to pick out crashes that are most likely to be exploitable and list those cases in a ranked order. FOE 2.0.1 fixes a bug in <code>drillresults.py</code> that could have caused it to overlook some interesting cases.</p>
<p>To use this script, run<br />
<code>tools\drillresults.py<br />
</code></p>
<p>For command-line usage, run<br />
<code>tools\drillresults.py --help</code></p>
<p><strong>Both Platforms Reflect Bug Fixes<br />
</strong></p>
<p>Spoiler alert: Software has bugs. Even software that finds bugs has bugs. BFF&nbsp;and FOE are no exception to this. We have fixed the ones we found since their respective prior releases. Most of these were minor, but one notable fix was that crash recycling wasn't working as well as we had intended in BFF 2.5 and FOE 2.0. We've fixed that in BFF 2.6 and FOE 2.0.1.</p>
<p><strong>Read the Quick Start Instructions<br />
</strong></p>
<p>Quick start instructions for both tools can be found on their download pages: <a href="http://www.cert.org/download/bff/">BFF 2.6</a>, <a href="http://www.cert.org/download/foe/">FOE 2.0.1</a>.</p>
<p><strong>Contact Us</strong></p>
<p>If you have any questions or comments, please feel free to <a href="mailto:cert@cert.org?subject=CERT%2FCC%20BFF%202.6%20Feedback%20INFO%23817809">contact us</a>.</p>]]>
    </content>
</entry>

<entry>
    <title>Java 7 Attack Vectors, Oh My!</title>
    <link rel="alternate" type="text/html" href="https://www.cert.org/blogs/certcc/2012/09/java_7_attack_vectors_oh_my.html" />
    <id>tag:www.cert.org,2012:/blogs/certcc//1.113</id>

    <published>2012-09-05T21:34:50Z</published>
    <updated>2012-09-05T21:34:50Z</updated>

    <summary><![CDATA[While researching how to successfully mitigate the recent Java 7 vulnerability (VU#636312, CVE-2012-4681), we (and by &quot;we&quot; I mean &quot;Will Dormann&quot;) found quite a mess. In the midst of discussion about exploit activity and the out-of-cycle update from Oracle, I'd...]]></summary>
    <author>
        <name>Art Manion</name>
        
    </author>
    
        <category term="Analysis" scheme="http://www.sixapart.com/ns/types#category" />
    
        <category term="Vulnerability" scheme="http://www.sixapart.com/ns/types#category" />
    
    <category term="cve20124681" label="CVE-2012-4681" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="java" label="java" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="javawebstart" label="java web start" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="jnlp" label="jnlp" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="jre" label="jre" scheme="http://www.sixapart.com/ns/types#tag" />
    <category term="vu636312" label="VU#636312" scheme="http://www.sixapart.com/ns/types#tag" />
    
    <content type="html" xml:lang="en" xml:base="https://www.cert.org/blogs/certcc/">
        <![CDATA[<p>While researching how to successfully mitigate the <a href="https://www.cert.org/blogs/certcc/2012/08/disabling_the_java_7_plug-in_o.html">recent Java 7 vulnerability</a> (<a href="http://www.kb.cert.org/vuls/id/636312">VU#636312</a>, <span><a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4681">CVE-2012-4681</a></span>), we (and by &quot;we&quot; I mean &quot;Will Dormann&quot;) found quite a mess. In the midst of discussion about exploit activity and the out-of-cycle update from Oracle, I'd like to call attention to a couple other important points.</p>]]>
        <![CDATA[<p><strong>First</strong>, there's the question of the defensive value of the Java 7u7 update (and patching in general). You want to defend against Java attacks. Is installing the update necessary? Yes. Is it sufficient? No.</p> <p>Recall that Security Explorations has reported more than one Java vulnerabilities. According to the <a href="http://www.security-explorations.com/en/SE-2012-01-faq.html">FAQ</a> for SE-2012-01, 4 out of 30 issues were addressed in Java 7u7. Furthermore, Security Explorations <a href="http://seclists.org/fulldisclosure/2012/Aug/388">posted this</a> on August 31:</p> <p style="margin-left: 40px;"><cite>Today  we sent a security vulnerability report along with a Proof of Concept  code to Oracle. The code successfully demonstrates a complete JVM  sandbox bypass in the environment of a latest Java SE software (version 7  Update 7 released on Aug 30, 2012). The reason for it is a new security  issue discovered, that made exploitation of some of our not yet  addressed bugs possible to exploit again.</cite></p> <p>How long will it take for <a href="http://seclists.org/fulldisclosure/2012/Aug/387">someone else</a> to find a Java 7 vulnerability and develop stable exploit code?</p> <p>Oracle released Java 7u7 out of cycle to address this vulnerability. Classic vulnerability disclosure: Scheduled releases make planning and management easier, but sometimes it's necessary to respond to an emergency like active exploitation. Oracle has also <a href="https://twitter.com/Oracle/status/241273986804240384">suggested</a> that it's not necessary to disable Java since there's an update available. Patch and forget!</p> <p>We strongly recommend disabling Java support in web browsers&mdash;and also applying any and all Java security updates.</p> <p><strong>Second</strong>, it's surprisingly difficult to completely disable Java support in web browsers. There are multiple ways to invoke Java, and each one is a potential attack vector: the Java plug-in, the Java Deployment Toolkit plug-in, the next generation Java plug-in, Java Web Start, and in Internet Explorer, hundreds of ActiveX controls. Disabling Java support in IE is by far the most complicated. We've got a 2,379-line registry file to help and more browser-specific advice in <a href="http://www.kb.cert.org/vuls/id/636312#solution">VU#636312</a>.</p> <p>So keep these things in mind:</p> <ol>     <li>Java-through-the-browser is high threat, and it will be for some time.</li>     <li>Updating isn't good enough.</li>     <li>It's harder than you'd think to disable Java-through-the-browser.</li> </ol> <p>Let me repeat: We strongly recommend disabling Java support in web browsers.  And leave it off.</p>]]>
    </content>
</entry>

</feed>
